Laurens,
Sounds like you had some success using the prefix
"AWSLogs/<aws_id>/CloudTrail/ap-northeast-1/2017/07/03/", is that right? If
so, when you right-click and choose "View State", is the timestamp and
latest key name stored?
Try changing the prefix to
"AWSLogs/<aws_id>/CloudTrail/ap-northeast-1/2017/07/", clearing the
existing state (right-click => "View State" => "Clear State"), and start
the process again. Does it continue to produce files? What happens as you
continue to go up the directory structure (adjusting the prefix and
clearing the state)? Does it stop producing files at some point?
Keep in mind that for this use case the prefix should always end in a
forward slash ('/').
In our case, we've been using ListS3 to ingest CloudTrail logs on NiFi
1.1.1 for some time, and it has always recursed into S3 "subdirectories" as
expected.
Hope that helps,
Adam
