15-cloudtrail-filter.conf

filter {
  if [type] == "cloudtrail" {
    geoip {
      source => "sourceIPAddress"
      target => "geoip"
      add_tag => [ "cloudtrail-geoip" ]
    }
  }
}