By default, CloudTrail logs all events for the last 90 days in your account. However, to link it with CloudWatch, you’ll need to create a Trail, which keeps records of events for longer, and also has the option to keep extended logs on individual S3 writes and Lambda invocations.
Read This Article on CloudSavvy IT ›
Source : How to Send CloudTrail Logs to CloudWatch and Elasticsearch
