Repository: elastic/integrations
Pull request #13486: Updating grok pattern for awss3 access ingest pipeline
Author: login: gizas
Labels: name: Integration:aws
description: AWS
name: Team:obs-ds-hosted-services
description: Observability Hosted Services team [elastic/obs-ds-hosted-services]
Created: 2025-04-09T15:09:49Z | Merged: 2025-04-11T13:14:51Z

- Enhancement

## Proposed commit message

- WHAT: Update the Grok pattern for AWS S3 access ingest pipeline
- WHY:  Allign with [Amazon S3 server access log format](https://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.html)


## Checklist

- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.
- [x] I have verified that all data streams collect metrics or logs.
- [x] I have added an entry to my package's `changelog.yml` file.
- [x] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).
- [x] I have verified that any added dashboard complies with Kibana's [Dashboard good practices](https://docs.elastic.dev/ux-guidelines/data-viz/dashboard-good-practices) 

## How to test this PR locally

Use the Grok debugger


![Screenshot 2025-04-09 at 6 03 17 PM](https://github.com/user-attachments/assets/e31a56c3-73a3-4cd8-b796-f139b7f07837)




Diff:
diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml
index 2c5462eb0bd..bedd2316e1f 100644
--- a/packages/aws/changelog.yml
+++ b/packages/aws/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.45.2"
+  changes:
+    - description: Update grok pattern for AWS S3 access ingest pipeline
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/13486
 - version: "2.45.1"
   changes:
     - description: Fix handling of SQS worker count configuration.
diff --git a/packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log b/packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log
index bcc9f6af0d2..514104a7278 100644
--- a/packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log
+++ b/packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log
@@ -5,3 +5,7 @@
 36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 jsoriano-s3-test [10/Sep/2019:15:11:07 +0000] 89.160.20.156 arn:aws:iam::123456:user/test@elastic.co 8CD7A4A71E2E5C9E BATCH.DELETE.OBJECT jolokia-war-1.5.0.war - 204 - - 344017 - - - - - IeDW5I3wefFxU8iHOcAzi5qr+O+1bdRlcQ0AO2WGjFh7JwYM6qCoKq+1TrUshrXMlBxPFtg97Vk= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.eu-central-1.amazonaws.com TLSv1.2
 36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 test-s3-ks [19/Sep/2019:17:06:39 +0000] 89.160.20.156 arn:aws:iam::123456:user/test@elastic.co 6CE38F1312D32BDD BATCH.DELETE.OBJECT Screen+Shot+2019-09-09+at+9.08.44+AM.png - 204 - - 57138 - - - - - LwRa4w6DbuU48GKQiH3jDbjfTyLCbwasFBsdttugRQ+9lH4jK8lT91+HhGZKMYI3sPyKuQ9LvU0= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.ap-southeast-1.amazonaws.com TLSv1.2
 67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" 200 - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 -
+67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" 200 - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP Yes
+67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" - - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP -
+b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7 flow-log-test [25/Mar/2025:19:28:02 +0000] - AmazonS3 366DB3C4B325AB11 S3.EXPIRE.OBJECT 0/chum/_vars/logtests/PlannerModule/5f6ea3b7da96ab304a77225d5b2b2a55e54b74e4ddfdf14b9b1d853d77515b88_9febba22f08b11ef8cf6020058a9efab/2024/12/30/164700/kitt_189/_spcu_sride__state_svx__feature__flags.sst "-" - - - 317 - - "-" "-" qsEq9bDa2VyxyZ4cz0c7oBnF67VYTTij DMlPb9al4CvVBck150CgpEIIYgtSI3HC/atetNVYwPtHZffW6jfpg+BrffhbT9/B - - - - - - -
+b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7 flow-log-test [25/Mar/2025:19:28:02 +0000] - AmazonS3 366DB3C4B325AB11 S3.EXPIRE.OBJECT 0/chum/_vars/logtests/PlannerModule/5f6ea3b7da96ab304a77225d5b2b2a55e54b74e4ddfdf14b9b1d853d77515b88_9febba22f08b11ef8cf6020058a9efab/2024/12/30/164700/kitt_189/_spcu_sride__state_svx__feature__flags.sst "-" - - - 317 - - "-" "-" qsEq9bDa2VyxyZ4cz0c7oBnF67VYTTij DMlPb9al4CvVBck150CgpEIIYgtSI3HC/atetNVYwPtHZffW6jfpg+BrffhbT9/B - - - - - - Yes
diff --git a/packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log-expected.json b/packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log-expected.json
index ccba9840760..f14a314f402 100644
--- a/packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log-expected.json
+++ b/packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log-expected.json
@@ -753,6 +753,258 @@
                 "original": "/AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz",
                 "path": "/AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz"
             }
+        },
+        {
+            "@timestamp": "2021-07-14T18:57:31.000Z",
+            "aws": {
+                "s3access": {
+                    "aclrequired": "Yes",
+                    "authentication_type": "AuthHeader",
+                    "bucket": "flow-log-test",
+                    "bucket_owner": "67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b",
+                    "cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256",
+                    "host_header": "flow-log-test.s3.us-gov-west-1.amazonaws.com",
+                    "host_id": "02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4=",
+                    "http_status": 200,
+                    "key": "AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz",
+                    "object_size": 773,
+                    "operation": "REST.PUT.OBJECT",
+                    "access_point_arn": "arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP",
+                    "request_id": "MVGXZXEVN3IG9S24",
+                    "request_uri": "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1",
+                    "requester": "svc:delivery.logs.amazonaws.com",
+                    "signature_version": "SigV4",
+                    "tls_version": "TLSv1.2",
+                    "total_time": 103,
+                    "turn_around_time": 13
+                }
+            },
+            "client": {
+                "user": {
+                    "id": "svc:delivery.logs.amazonaws.com"
+                }
+            },
+            "cloud": {
+                "provider": "aws",
+                "region": "us-gov-west-1"
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "REST.PUT.OBJECT",
+                "category": [
+                    "web"
+                ],
+                "duration": 103000000,
+                "id": "MVGXZXEVN3IG9S24",
+                "kind": "event",
+                "original": "67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz \"PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1\" 200 - - 773 103 13 \"-\" \"-\" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP Yes",
+                "outcome": "success",
+                "type": [
+                    "access"
+                ]
+            },
+            "http": {
+                "request": {
+                    "method": "PUT"
+                },
+                "response": {
+                    "status_code": 200
+                },
+                "version": "1.1"
+            },
+            "related": {
+                "user": [
+                    "67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b"
+                ]
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "tls": {
+                "cipher": "ECDHE-RSA-AES128-GCM-SHA256",
+                "version": "1.2",
+                "version_protocol": "tls"
+            },
+            "url": {
+                "extension": "gz",
+                "original": "/AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz",
+                "path": "/AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz"
+            }
+        },
+        {
+            "@timestamp": "2021-07-14T18:57:31.000Z",
+            "aws": {
+                "s3access": {
+                    "authentication_type": "AuthHeader",
+                    "bucket": "flow-log-test",
+                    "bucket_owner": "67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b",
+                    "cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256",
+                    "host_header": "flow-log-test.s3.us-gov-west-1.amazonaws.com",
+                    "host_id": "02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4=",
+                    "key": "AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz",
+                    "object_size": 773,
+                    "operation": "REST.PUT.OBJECT",
+                    "access_point_arn": "arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP",
+                    "request_id": "MVGXZXEVN3IG9S24",
+                    "request_uri": "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1",
+                    "requester": "svc:delivery.logs.amazonaws.com",
+                    "signature_version": "SigV4",
+                    "tls_version": "TLSv1.2",
+                    "total_time": 103,
+                    "turn_around_time": 13
+                }
+            },
+            "client": {
+                "user": {
+                    "id": "svc:delivery.logs.amazonaws.com"
+                }
+            },
+            "cloud": {
+                "provider": "aws",
+                "region": "us-gov-west-1"
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "REST.PUT.OBJECT",
+                "category": [
+                    "web"
+                ],
+                "duration": 103000000,
+                "id": "MVGXZXEVN3IG9S24",
+                "kind": "event",
+                "original": "67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz \"PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1\" - - - 773 103 13 \"-\" \"-\" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP -",
+                "outcome": "success",
+                "type": [
+                    "access"
+                ]
+            },
+            "http": {
+                "request": {
+                    "method": "PUT"
+                },
+                "version": "1.1"
+            },
+            "related": {
+                "user": [
+                    "67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b"
+                ]
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "tls": {
+                "cipher": "ECDHE-RSA-AES128-GCM-SHA256",
+                "version": "1.2",
+                "version_protocol": "tls"
+            },
+            "url": {
+                "extension": "gz",
+                "original": "/AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz",
+                "path": "/AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz"
+            }
+        },
+        {
+            "@timestamp": "2025-03-25T19:28:02.000Z",
+            "aws": {
+                "s3access": {
+                    "bucket": "flow-log-test",
+                    "bucket_owner": "b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7",
+                    "host_id": "DMlPb9al4CvVBck150CgpEIIYgtSI3HC/atetNVYwPtHZffW6jfpg+BrffhbT9/B",
+                    "key": "0/chum/_vars/logtests/PlannerModule/5f6ea3b7da96ab304a77225d5b2b2a55e54b74e4ddfdf14b9b1d853d77515b88_9febba22f08b11ef8cf6020058a9efab/2024/12/30/164700/kitt_189/_spcu_sride__state_svx__feature__flags.sst",
+                    "object_size": 317,
+                    "operation": "S3.EXPIRE.OBJECT",
+                    "request_id": "366DB3C4B325AB11",
+                    "request_uri": "-",
+                    "requester": "AmazonS3",
+                    "version_id": "qsEq9bDa2VyxyZ4cz0c7oBnF67VYTTij"
+                }
+            },
+            "client": {
+                "user": {
+                    "id": "AmazonS3"
+                }
+            },
+            "cloud": {
+                "provider": "aws"
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "S3.EXPIRE.OBJECT",
+                "category": [
+                    "web"
+                ],
+                "id": "366DB3C4B325AB11",
+                "kind": "event",
+                "original": "b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7 flow-log-test [25/Mar/2025:19:28:02 +0000] - AmazonS3 366DB3C4B325AB11 S3.EXPIRE.OBJECT 0/chum/_vars/logtests/PlannerModule/5f6ea3b7da96ab304a77225d5b2b2a55e54b74e4ddfdf14b9b1d853d77515b88_9febba22f08b11ef8cf6020058a9efab/2024/12/30/164700/kitt_189/_spcu_sride__state_svx__feature__flags.sst \"-\" - - - 317 - - \"-\" \"-\" qsEq9bDa2VyxyZ4cz0c7oBnF67VYTTij DMlPb9al4CvVBck150CgpEIIYgtSI3HC/atetNVYwPtHZffW6jfpg+BrffhbT9/B - - - - - - -",
+                "outcome": "success",
+                "type": [
+                    "access"
+                ]
+            },
+            "related": {
+                "user": [
+                    "b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7"
+                ]
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2025-03-25T19:28:02.000Z",
+            "aws": {
+                "s3access": {
+                    "aclrequired": "Yes",
+                    "bucket": "flow-log-test",
+                    "bucket_owner": "b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7",
+                    "host_id": "DMlPb9al4CvVBck150CgpEIIYgtSI3HC/atetNVYwPtHZffW6jfpg+BrffhbT9/B",
+                    "key": "0/chum/_vars/logtests/PlannerModule/5f6ea3b7da96ab304a77225d5b2b2a55e54b74e4ddfdf14b9b1d853d77515b88_9febba22f08b11ef8cf6020058a9efab/2024/12/30/164700/kitt_189/_spcu_sride__state_svx__feature__flags.sst",
+                    "object_size": 317,
+                    "operation": "S3.EXPIRE.OBJECT",
+                    "request_id": "366DB3C4B325AB11",
+                    "request_uri": "-",
+                    "requester": "AmazonS3",
+                    "version_id": "qsEq9bDa2VyxyZ4cz0c7oBnF67VYTTij"
+                }
+            },
+            "client": {
+                "user": {
+                    "id": "AmazonS3"
+                }
+            },
+            "cloud": {
+                "provider": "aws"
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "S3.EXPIRE.OBJECT",
+                "category": [
+                    "web"
+                ],
+                "id": "366DB3C4B325AB11",
+                "kind": "event",
+                "original": "b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7 flow-log-test [25/Mar/2025:19:28:02 +0000] - AmazonS3 366DB3C4B325AB11 S3.EXPIRE.OBJECT 0/chum/_vars/logtests/PlannerModule/5f6ea3b7da96ab304a77225d5b2b2a55e54b74e4ddfdf14b9b1d853d77515b88_9febba22f08b11ef8cf6020058a9efab/2024/12/30/164700/kitt_189/_spcu_sride__state_svx__feature__flags.sst \"-\" - - - 317 - - \"-\" \"-\" qsEq9bDa2VyxyZ4cz0c7oBnF67VYTTij DMlPb9al4CvVBck150CgpEIIYgtSI3HC/atetNVYwPtHZffW6jfpg+BrffhbT9/B - - - - - - Yes",
+                "outcome": "success",
+                "type": [
+                    "access"
+                ]
+            },
+            "related": {
+                "user": [
+                    "b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7"
+                ]
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
         }
     ]
 }
\ No newline at end of file
diff --git a/packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml
index b1dbbfa3090..23c6d11c816 100644
--- a/packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml
+++ b/packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml
@@ -29,11 +29,11 @@ processors:
           %{BASE16NUM:aws.s3access.bucket_owner} %{HOSTNAME:aws.s3access.bucket} \[%{HTTPDATE:_temp_.s3access_time}\]
           (?:-|%{IP:aws.s3access.remote_ip}) (?:-|%{S3REQUESTER:aws.s3access.requester}) %{S3REQUESTID:aws.s3access.request_id}
           %{S3OPERATION:aws.s3access.operation} (?:-|%{S3KEY:aws.s3access.key}) (?:-|\"%{DATA:aws.s3access.request_uri}\")
-          %{NUMBER:aws.s3access.http_status:long} (?:-|%{WORD:aws.s3access.error_code}) (?:-|%{NUMBER:aws.s3access.bytes_sent:long})
+          (?:-|%{NUMBER:aws.s3access.http_status:long}) (?:-|%{WORD:aws.s3access.error_code}) (?:-|%{NUMBER:aws.s3access.bytes_sent:long})
           (?:-|%{NUMBER:aws.s3access.object_size:long}) (?:-|%{NUMBER:aws.s3access.total_time:long}) (?:-|%{NUMBER:aws.s3access.turn_around_time:long})
           (?:-|\"-\"|\"%{DATA:aws.s3access.referrer}\") (?:-|\"(-|%{DATA:aws.s3access.user_agent})\") (?:-|%{S3KEY:aws.s3access.version_id})
           (?:-|%{S3ID:aws.s3access.host_id}) (?:-|%{S3VERSION:aws.s3access.signature_version}) (?:-|%{S3KEY:aws.s3access.cipher_suite})
-          (?:-|%{WORD:aws.s3access.authentication_type}) (?:-|%{S3ID:aws.s3access.host_header}) (?:-|%{S3VERSION:aws.s3access.tls_version})
+          (?:-|%{WORD:aws.s3access.authentication_type}) (?:-|%{S3ID:aws.s3access.host_header}) (?:-|%{S3VERSION:aws.s3access.tls_version})(?: (?:-|%{S3REQUESTER:aws.s3access.access_point_arn}))?(?: (?:-|%{WORD:aws.s3access.aclrequired}))?
       pattern_definitions:
         S3REQUESTER: "[a-zA-Z0-9\\/_\\.\\-%:@]+"
         S3REQUESTID: "[a-zA-Z0-9]+"
@@ -179,6 +179,14 @@ processors:
         }
         ctx.tls.version = parts[1];
         ctx.tls.version_protocol = parts[0]
+  - set:
+      field: aws.s3access.access_point_arn
+      value: '{{aws.s3access.access_point_arn}}'
+      ignore_empty_value: true
+  - set:
+      field: aws.s3access.aclrequired
+      value: '{{aws.s3access.aclrequired}}'
+      ignore_empty_value: true
   - set:
       field: cloud.provider
       value: aws
diff --git a/packages/aws/data_stream/s3access/fields/fields.yml b/packages/aws/data_stream/s3access/fields/fields.yml
index b0b0dcc44e3..408f0381577 100644
--- a/packages/aws/data_stream/s3access/fields/fields.yml
+++ b/packages/aws/data_stream/s3access/fields/fields.yml
@@ -93,6 +93,14 @@
       type: keyword
       description: |
         The Transport Layer Security (TLS) version negotiated by the client.
+    - name: aclrequired
+      type: keyword
+      description: |
+        Whether the ACL was required for the request.
+    - name: access_point_arn
+      type: keyword
+      description: |
+          The Amazon Resource Name (ARN) of the access point of the request.
 - name: geo.city_name
   type: keyword
   description: City name.
diff --git a/packages/aws/docs/s3.md b/packages/aws/docs/s3.md
index 30d1b805e92..26b8c759514 100644
--- a/packages/aws/docs/s3.md
+++ b/packages/aws/docs/s3.md
@@ -63,6 +63,8 @@ Please refer to the following [document](https://www.elastic.co/guide/en/ecs/cur
 | aws.s3.bucket.arn | The AWS S3 bucket ARN. | keyword |
 | aws.s3.bucket.name | The AWS S3 bucket name. | keyword |
 | aws.s3.object.key | The AWS S3 Object key. | keyword |
+| aws.s3access.access_point_arn | The Amazon Resource Name (ARN) of the access point of the request. | keyword |
+| aws.s3access.aclrequired | Whether the ACL was required for the request. | keyword |
 | aws.s3access.authentication_type | The type of request authentication used, AuthHeader for authentication headers, QueryString for query string (pre-signed URL) or a - for unauthenticated requests. | keyword |
 | aws.s3access.bucket | The name of the bucket that the request was processed against. | keyword |
 | aws.s3access.bucket_owner | The canonical user ID of the owner of the source bucket. | keyword |
diff --git a/packages/aws/manifest.yml b/packages/aws/manifest.yml
index d6b5d67392f..313b1b38330 100644
--- a/packages/aws/manifest.yml
+++ b/packages/aws/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 3.3.1
 name: aws
 title: AWS
-version: 2.45.1
+version: 2.45.2
 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
 type: integration
 categories:


Reviews:
user: login: Kavindu-Dodan
body: LGTM
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T15:44:30Z
user: login: zmoog
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T15:57:08Z
user: login: gizas
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T16:05:40Z
user: login: gizas
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T16:06:00Z
user: login: zmoog
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T17:48:44Z
user: login: gizas
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T09:40:10Z
user: login: zmoog
body: LGTM!

I just added a couple of non-blocking nits.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-11T10:47:22Z
user: login: gizas
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-11T11:01:43Z
user: login: gizas
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-11T11:10:43Z

Review comments:
diff_hunk: @@ -179,6 +179,14 @@ processors:
         }
         ctx.tls.version = parts[1];
         ctx.tls.version_protocol = parts[0]
+  - set:
+      field: aws.s3access.point_arn
+      value: '{{aws.s3access.point_arn}}'
+      ignore_empty_value: true
+  - set:
+      field: aws.s3access.aclrequired
+      value: '{{aws.s3access.aclrequired}}'
+      ignore_empty_value: true
path: packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml
user: login: zmoog
body: Two questions on the `aws.s3access.aclrequired` field.

- Does this field get an appropriate mapping from ECS, or must we add a dedicated mapping? What field type gets used?
- Did you consider mapping this field as `boolean` but decide differently?

created_at: 2025-04-09T15:55:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -179,6 +179,14 @@ processors:
         }
         ctx.tls.version = parts[1];
         ctx.tls.version_protocol = parts[0]
+  - set:
+      field: aws.s3access.point_arn
+      value: '{{aws.s3access.point_arn}}'
+      ignore_empty_value: true
+  - set:
+      field: aws.s3access.aclrequired
+      value: '{{aws.s3access.aclrequired}}'
+      ignore_empty_value: true
path: packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml
user: login: gizas
body: The Access Point ARN is like: arn:aws:s3:us-east-1:123456789012:accesspoint/example-AP

The aclRequired is Yes or If no ACLs were required, the string is -. So it is not boolean that is why decided like this. See [Amazon S3 server access log format](https://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.html)

Do you think both shall we update them? I dont see sth relevant in ECS


created_at: 2025-04-09T16:05:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -179,6 +179,14 @@ processors:
         }
         ctx.tls.version = parts[1];
         ctx.tls.version_protocol = parts[0]
+  - set:
+      field: aws.s3access.point_arn
+      value: '{{aws.s3access.point_arn}}'
+      ignore_empty_value: true
+  - set:
+      field: aws.s3access.aclrequired
+      value: '{{aws.s3access.aclrequired}}'
+      ignore_empty_value: true
path: packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml
user: login: gizas
body: I also have pipeline errors in the test that I should check why
created_at: 2025-04-09T16:06:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -179,6 +179,14 @@ processors:
         }
         ctx.tls.version = parts[1];
         ctx.tls.version_protocol = parts[0]
+  - set:
+      field: aws.s3access.point_arn
+      value: '{{aws.s3access.point_arn}}'
+      ignore_empty_value: true
+  - set:
+      field: aws.s3access.aclrequired
+      value: '{{aws.s3access.aclrequired}}'
+      ignore_empty_value: true
path: packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml
user: login: zmoog
body: > Do you think both shall we update them? I dont see sth relevant in ECS

ES maps both fields as `keyword` fields, right?
created_at: 2025-04-09T17:48:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -179,6 +179,14 @@ processors:
         }
         ctx.tls.version = parts[1];
         ctx.tls.version_protocol = parts[0]
+  - set:
+      field: aws.s3access.point_arn
+      value: '{{aws.s3access.point_arn}}'
+      ignore_empty_value: true
+  - set:
+      field: aws.s3access.aclrequired
+      value: '{{aws.s3access.aclrequired}}'
+      ignore_empty_value: true
path: packages/aws/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml
user: login: gizas
body: You were right, I needed to define the mapping in the fields.yml @zmoog . So now both are keywords

Addionally I have updated the grok pattern for those latest two fields. In more details:
Match the last two fields only if they are present
 - If point_arn or aclrequired exist, parse them.
 - If not, skip them gracefully without causing failure. 
Reason for that was that did not want to update the existing logs that did not have those two fields and wanted to make our grok "running" in all scenarios.

Addtionally I added an "s3" log access entry
created_at: 2025-04-10T09:40:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -93,6 +93,14 @@
       type: keyword
       description: |
         The Transport Layer Security (TLS) version negotiated by the client.
+    - name: aclrequired
+      type: keyword
+      description: |
+        Whether the ACL was required for the request.
+    - name: point_arn
+      type: keyword
+      description: |
+          The Amazon Resource Name (ARN) of the access point of the request.
path: packages/aws/data_stream/s3access/fields/fields.yml
user: login: zmoog
body: nit:

I see we named the new field `point_arn`. 

Since the log field name is "Access Point ARN", shouldn't we call this `access_point_arn`?

I know, by using `aws.s3access.access_point_arn` feels like we're repeating "acccess", but the two "access"-es names have different semantics:

- Amazon S3 server access (log format)
- Access Point ARN (log field)


created_at: 2025-04-11T10:41:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -5,3 +5,6 @@
 36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 jsoriano-s3-test [10/Sep/2019:15:11:07 +0000] 89.160.20.156 arn:aws:iam::123456:user/test@elastic.co 8CD7A4A71E2E5C9E BATCH.DELETE.OBJECT jolokia-war-1.5.0.war - 204 - - 344017 - - - - - IeDW5I3wefFxU8iHOcAzi5qr+O+1bdRlcQ0AO2WGjFh7JwYM6qCoKq+1TrUshrXMlBxPFtg97Vk= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.eu-central-1.amazonaws.com TLSv1.2
 36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 test-s3-ks [19/Sep/2019:17:06:39 +0000] 89.160.20.156 arn:aws:iam::123456:user/test@elastic.co 6CE38F1312D32BDD BATCH.DELETE.OBJECT Screen+Shot+2019-09-09+at+9.08.44+AM.png - 204 - - 57138 - - - - - LwRa4w6DbuU48GKQiH3jDbjfTyLCbwasFBsdttugRQ+9lH4jK8lT91+HhGZKMYI3sPyKuQ9LvU0= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.ap-southeast-1.amazonaws.com TLSv1.2
 67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" 200 - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 -
+67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" 200 - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP Yes
+67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" - - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP -
+b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7 flow-log-test [25/Mar/2025:19:28:02 +0000] - AmazonS3 366DB3C4B325AB11 S3.EXPIRE.OBJECT 0/chum/_vars/logtests/PlannerModule/5f6ea3b7da96ab304a77225d5b2b2a55e54b74e4ddfdf14b9b1d853d77515b88_9febba22f08b11ef8cf6020058a9efab/2024/12/30/164700/kitt_189/_spcu_sride__state_svx__feature__flags.sst "-" - - - 317 - - "-" "-" qsEq9bDa2VyxyZ4cz0c7oBnF67VYTTij DMlPb9al4CvVBck150CgpEIIYgtSI3HC/atetNVYwPtHZffW6jfpg+BrffhbT9/B - - - - - - -
path: packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log
user: login: zmoog
body: nit:

While reading the log examples [Amazon S3 server access log format](https://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.html), I noticed we can have an `aclrequired` without `access_point_arn`:

```text
79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be amzn-s3-demo-bucket1 [06/Feb/2019:00:00:38 +0000] 192.0.2.3 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be 3E57427F3EXAMPLE REST.GET.VERSIONING - "GET /amzn-s3-demo-bucket1?versioning HTTP/1.1" 200 - 113 - 7 - "-" "S3Console/0.4" - s9lzHYrFp76ZVxRcpX9+5cjAnEH2ROuNkd2BHfIa6UkFVdtjf5mKR3/eTPFvsiP/XV/VLi31234= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader amzn-s3-demo-bucket1.s3.us-west-1.amazonaws.com TLSV1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP Yes
79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be amzn-s3-demo-bucket1 [06/Feb/2019:00:00:38 +0000] 192.0.2.3 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be 891CE47D2EXAMPLE REST.GET.LOGGING_STATUS - "GET /amzn-s3-demo-bucket1?logging HTTP/1.1" 200 - 242 - 11 - "-" "S3Console/0.4" - 9vKBE6vMhrNiWHZmb2L0mXOcqPGzQOI5XLnCtZNPxev+Hf+7tpT6sxDwDty4LHBUOZJG96N1234= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader amzn-s3-demo-bucket1.s3.us-west-1.amazonaws.com TLSV1.2 - -
79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be amzn-s3-demo-bucket1 [06/Feb/2019:00:00:38 +0000] 192.0.2.3 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be A1206F460EXAMPLE REST.GET.BUCKETPOLICY - "GET /amzn-s3-demo-bucket1?policy HTTP/1.1" 404 NoSuchBucketPolicy 297 - 38 - "-" "S3Console/0.4" - BNaBsXZQQDbssi6xMBdBU2sLt+Yf5kZDmeBUP35sFoKa3sLLeMC78iwEIWxs99CRUrbS4n11234= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader amzn-s3-demo-bucket1.s3.us-west-1.amazonaws.com TLSV1.2 - Yes 
79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be amzn-s3-demo-bucket1 [06/Feb/2019:00:01:00 +0000] 192.0.2.3 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be 7B4A0FABBEXAMPLE REST.GET.VERSIONING - "GET /amzn-s3-demo-bucket1?versioning HTTP/1.1" 200 - 113 - 33 - "-" "S3Console/0.4" - Ke1bUcazaN1jWuUlPJaxF64cQVpUEhoZKEG/hmy/gijN/I1DeWqDfFvnpybfEseEME/u7ME1234= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader amzn-s3-demo-bucket1.s3.us-west-1.amazonaws.com TLSV1.2 - -
79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be amzn-s3-demo-bucket1 [06/Feb/2019:00:01:57 +0000] 192.0.2.3 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be DD6CC733AEXAMPLE REST.PUT.OBJECT s3-dg.pdf "PUT /amzn-s3-demo-bucket1/s3-dg.pdf HTTP/1.1" 200 - - 4406583 41754 28 "-" "S3Console/0.4" - 10S62Zv81kBW7BB6SX4XJ48o6kpcl6LPwEoizZQQxJd5qDSCTLX0TgS37kYUBKQW3+bPdrg1234= SigV4 ECDHE-RSA-AES128-SHA AuthHeader amzn-s3-demo-bucket1.s3.us-west-1.amazonaws.com TLSV1.2 - Yes 
```

What about adding one more test case with `aclrequired` and no `access_point_arn`?
created_at: 2025-04-11T10:46:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -5,3 +5,6 @@
 36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 jsoriano-s3-test [10/Sep/2019:15:11:07 +0000] 89.160.20.156 arn:aws:iam::123456:user/test@elastic.co 8CD7A4A71E2E5C9E BATCH.DELETE.OBJECT jolokia-war-1.5.0.war - 204 - - 344017 - - - - - IeDW5I3wefFxU8iHOcAzi5qr+O+1bdRlcQ0AO2WGjFh7JwYM6qCoKq+1TrUshrXMlBxPFtg97Vk= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.eu-central-1.amazonaws.com TLSv1.2
 36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 test-s3-ks [19/Sep/2019:17:06:39 +0000] 89.160.20.156 arn:aws:iam::123456:user/test@elastic.co 6CE38F1312D32BDD BATCH.DELETE.OBJECT Screen+Shot+2019-09-09+at+9.08.44+AM.png - 204 - - 57138 - - - - - LwRa4w6DbuU48GKQiH3jDbjfTyLCbwasFBsdttugRQ+9lH4jK8lT91+HhGZKMYI3sPyKuQ9LvU0= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.ap-southeast-1.amazonaws.com TLSv1.2
 67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" 200 - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 -
+67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" 200 - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP Yes
+67797214d75628047d9c76b18a78cded1a4b069b71f2a9d5a53649c38da8770b flow-log-test [14/Jul/2021:18:57:31 +0000] - svc:delivery.logs.amazonaws.com MVGXZXEVN3IG9S24 REST.PUT.OBJECT AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-_20210713T1855Z_f12aa632.log.gz "PUT /AWSLogs/000000000000/vpcflowlogs/us-gov-east-1/2021/07/13/000000000000_vpcflowlogs_us-gov-east-1_fl-0e7c13bf00cf15bfe_20210713T1855Z_f12aa632.log.gz HTTP/1.1" - - - 773 103 13 "-" "-" - 02SxwfXpO5UysN0GsKGa3uGDQ6E/W7+Hwo/luRH8p1VEexULoe66RCM+nja0dEq2JqLrtgjocvVRRkVt4= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader flow-log-test.s3.us-gov-west-1.amazonaws.com TLSv1.2 arn:aws:s3:us-west-1:123456789012:accesspoint/example-AP -
+b854390a51155554b82ce2759564a1135bce83133d004f4d2001f157e13985d7 flow-log-test [25/Mar/2025:19:28:02 +0000] - AmazonS3 366DB3C4B325AB11 S3.EXPIRE.OBJECT 0/chum/_vars/logtests/PlannerModule/5f6ea3b7da96ab304a77225d5b2b2a55e54b74e4ddfdf14b9b1d853d77515b88_9febba22f08b11ef8cf6020058a9efab/2024/12/30/164700/kitt_189/_spcu_sride__state_svx__feature__flags.sst "-" - - - 317 - - "-" "-" qsEq9bDa2VyxyZ4cz0c7oBnF67VYTTij DMlPb9al4CvVBck150CgpEIIYgtSI3HC/atetNVYwPtHZffW6jfpg+BrffhbT9/B - - - - - - -
path: packages/aws/data_stream/s3access/_dev/test/pipeline/test-s3-server-access.log
user: login: gizas
body: Thank you !!!! See https://github.com/elastic/integrations/pull/13486/files#diff-cfaeb40449052437fd70dab8b97c34a5ca487ca7ef374d7473422ac76dba9371R11 added
created_at: 2025-04-11T11:01:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -93,6 +93,14 @@
       type: keyword
       description: |
         The Transport Layer Security (TLS) version negotiated by the client.
+    - name: aclrequired
+      type: keyword
+      description: |
+        Whether the ACL was required for the request.
+    - name: point_arn
+      type: keyword
+      description: |
+          The Amazon Resource Name (ARN) of the access point of the request.
path: packages/aws/data_stream/s3access/fields/fields.yml
user: login: gizas
body: Renamed in [renaming point_arn to access_point_arn](https://github.com/elastic/integrations/pull/13486/commits/1dffa9c122ca9582d3b330e12cfecb80fc6c8451)
created_at: 2025-04-11T11:10:43Z
author_association: CONTRIBUTOR

PR comments:
user: login: elastic-vault-github-plugin-prod[bot]
created_at: 2025-04-10T11:14:47Z
body: ### :rocket: Benchmarks report


#### Package `aws` :&#43;1:(10) :green_heart:(3) :broken_heart:(6)
<details>
<summary>Expand to view</summary>

Data stream | Previous EPS | New EPS | Diff (%) | Result
----------- | ------------ | ------- | -------- | ------
`route53_resolver_logs` | 8547.01 | 4366.81 | -4180.2 (-48.91%) | :broken_heart:
`apigateway_logs` | 10526.32 | 6535.95 | -3990.37 (-37.91%) | :broken_heart:
`cloudwatch_logs` | 333333.33 | 250000 | -83333.33 (-25%) | :broken_heart:
`ec2_logs` | 45454.55 | 28571.43 | -16883.12 (-37.14%) | :broken_heart:
`emr_logs` | 16129.03 | 10526.32 | -5602.71 (-34.74%) | :broken_heart:
`firewall_logs` | 3039.51 | 2493.77 | -545.74 (-17.95%) | :broken_heart:
</details>


To see the full report comment with `/test benchmark fullreport`
<!--COMMENT_GENERATED_WITH_ID_benchmark-report-->
author_association: NONE
user: login: elastic-sonarqube[bot]
created_at: 2025-04-11T12:45:13Z
body: ## [![Quality Gate passed](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonar.elastic.dev/dashboard?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486) **Quality Gate passed**  
Issues  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486&resolved=false) [0 New issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486&resolved=false)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/fixed-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&fixedInPullRequest=13486) [0 Fixed issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&fixedInPullRequest=13486)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/accepted-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486&issueStatuses=ACCEPTED) [0 Accepted issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486&issueStatuses=ACCEPTED)

Measures  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/security_hotspots?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486) [0 Security Hotspots](https://sonar.elastic.dev/security_hotspots?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486&metric=new_coverage&view=list) [100.0% Coverage on New Code](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486&metric=new_coverage&view=list)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486&metric=new_duplicated_lines_density&view=list) [0.0% Duplication on New Code](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube](https://sonar.elastic.dev/dashboard?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13486)


author_association: NONE
user: login: elasticmachine
created_at: 2025-04-11T12:45:28Z
body: ## :green_heart: Build Succeeded
* [Buildkite Build](https://buildkite.com/elastic/integrations/builds/24687)
* Commit: 1dffa9c122ca9582d3b330e12cfecb80fc6c8451

### History
* :green_heart: [Build #24644](https://buildkite.com/elastic/integrations/builds/24644) succeeded 225bb8f23ff8140589e18137f645dabdccd54ded
* :broken_heart: [Build #24617](https://buildkite.com/elastic/integrations/builds/24617) failed c853b079a4d18c07d729206c483461d341ebab93

<!--buildkite-pr-comment-integrations
{"builds":[{"buildStatus":{"state":"passed","success":true,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/24687","number":24687,"commit":"1dffa9c122ca9582d3b330e12cfecb80fc6c8451"},{"buildStatus":{"state":"passed","success":true,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/24644","number":24644,"commit":"225bb8f23ff8140589e18137f645dabdccd54ded"},{"buildStatus":{"state":"failed","success":false,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/24617","number":24617,"commit":"c853b079a4d18c07d729206c483461d341ebab93"}],"number":24687}
buildkite-pr-comment-->
author_association: NONE
user: login: elastic-vault-github-plugin-prod[bot]
created_at: 2025-04-11T13:33:26Z
body: Package aws - 2.45.2 containing this change is available at https://epr.elastic.co/package/aws/2.45.2/
author_association: NONE