How to load data from AWS CloudTrail to ElasticSearch
Learn how to use Airbyte to synchronize your AWS CloudTrail data into ElasticSearch within minutes.
Building your pipeline or Using Airbyte
Airbyte is the only open source solution empowering data teams to meet all their growing custom business demands in the new AI era.
Building in-house pipelines
- Inconsistent and inaccurate data
- Laborious and expensive
- Brittle and inflexible
After Airbyte
- Reliable and accurate
- Extensible and scalable for all your needs
- Deployed and governed your way
Start syncing with Airbyte in 3 easy steps within 10 minutes
Take a virtual tour
Demo video of Airbyte Cloud
Demo video of AI Connector Builder
Setup Complexities simplified!
Simple & Easy to use Interface
Airbyte is built to get out of your way. Our clean, modern interface walks you through setup, so you can go from zero to sync in minutes—without deep technical expertise.
Guided Tour: Assisting you in building connections
Whether you’re setting up your first connection or managing complex syncs, Airbyte’s UI and documentation help you move with confidence. No guesswork. Just clarity.
Airbyte AI Assistant that will act as your sidekick in building your data pipelines in Minutes
Airbyte’s built-in assistant helps you choose sources, set destinations, and configure syncs quickly. It’s like having a data engineer on call—without the overhead.
What sets Airbyte Apart
Modern GenAI Workflows
Streamline AI workflows with Airbyte: load unstructured data into vector stores like Pinecone, Weaviate, and Milvus. Supports RAG transformations with LangChain chunking and embeddings from OpenAI, Cohere, etc., all in one operation.
Move Large Volumes, Fast
Quickly get up and running with a 5-minute setup that enables both incremental and full refreshes for databases of any size, seamlessly scaling to handle large data volumes. Our optimized architecture overcomes performance bottlenecks, ensuring efficient data synchronization even as your datasets grow from gigabytes to petabytes.
An Extensible Open-Source Standard
More than 1,000 developers contribute to Airbyte’s connectors, different interfaces (UI, API, Terraform Provider, Python Library), and integrations with the rest of the stack. Airbyte’s AI Connector Builder lets you edit or add new connectors in minutes.
Full Control & Security
Airbyte secures your data with cloud-hosted, self-hosted or hybrid deployment options. Single Sign-On (SSO) and Role-Based Access Control (RBAC) ensure only authorized users have access with the right permissions. Airbyte acts as a HIPAA conduit and supports compliance with CCPA, GDPR, and SOC2.
Fully Featured & Integrated
Airbyte automates schema evolution for seamless data flow, and utilizes efficient Change Data Capture (CDC) for real-time updates. Select only the columns you need, and leverage our dbt integration for powerful data transformations.
Enterprise Support with SLAs
Airbyte Self-Managed Enterprise comes with dedicated support and guaranteed service level agreements (SLAs), ensuring that your data movement infrastructure remains reliable and performant, and expert assistance is available when needed.
What our users say
Raman Singh
Predictable, straightforward pricing model that simplified budgeting and significantly reduced overall spend
Chase Zieman
“Airbyte helped us accelerate our progress by years, compared to our competitors. We don’t need to worry about connectors and focus on creating value for our users instead of building infrastructure. That’s priceless. The time and energy saved allows us to disrupt and grow faster.”
Rupak Patel
"With Airbyte, we could just push a few buttons, allow API access, and bring all the data into Google BigQuery. By blending all the different marketing data sources, we can gain valuable insights."
How to Sync to Manually
Step 1: Create an S3 Bucket for CloudTrail Logs
First, set up an S3 bucket in your AWS account to store CloudTrail logs. Ensure that the bucket has the appropriate permissions for CloudTrail to write logs to it. You can use the AWS Management Console to create the bucket, and specify it as the destination when setting up your CloudTrail.
Step 2: Enable CloudTrail and Configure Log Delivery to S3
Enable AWS CloudTrail in your AWS account and configure it to deliver logs to the S3 bucket created in the previous step. Specify the S3 bucket name in the CloudTrail setup wizard and ensure that log file validation is enabled for security purposes.
Step 3: Set Up an S3 Event Notification
Set up an S3 event notification on the bucket to trigger an AWS Lambda function every time a new log file is created. This involves configuring the S3 bucket to send a notification to Lambda, using the AWS Management Console or AWS CLI. Select the event type (e.g., "All object create events") and specify the Lambda function that will process the logs.
Step 4: Create an AWS Lambda Function
Create a Lambda function with the necessary IAM role that has permissions to read from the S3 bucket and write to Elasticsearch. This function will be triggered by S3 event notifications. Write the function code to process the CloudTrail logs, extract relevant information, and format it for insertion into Elasticsearch.
Step 5: Deploy an Elasticsearch Cluster on AWS
Deploy an Elasticsearch cluster using Amazon OpenSearch Service (formerly AWS Elasticsearch Service). You can do this via the AWS Management Console, CLI, or CloudFormation. Configure the cluster settings, such as instance type, number of nodes, and security settings. Make sure the cluster is accessible from the Lambda function, potentially using a VPC if necessary.
Step 6: Write Data Transformation Logic in Lambda
In your Lambda function, implement logic to parse the CloudTrail log files, transform the data as needed, and prepare it for indexing into Elasticsearch. This typically involves converting the JSON format of CloudTrail logs into a structure compatible with Elasticsearch, such as indexing specific fields.
Step 7: Index Data into Elasticsearch
Use the AWS SDK within your Lambda function to send HTTP requests to your Elasticsearch cluster’s endpoint. Use the Elasticsearch Bulk API to efficiently index batches of transformed CloudTrail logs. Ensure error handling and logging are implemented in the Lambda function to handle any issues during the indexing process.
By following these steps, you can effectively move data from AWS CloudTrail to Elasticsearch without relying on third-party connectors or integrations, leveraging AWS-native services and capabilities.