CloudTrail Log to CSV Converter

Merge AWS CloudTrail .json.gz log objects from S3 and convert their Records to CSV or JSONL in your browser.

Choose CloudTrail log files

Select multiple .json.gz, .json, or .jsonl files

Drop files here or click to browse

Choose Files

Checks before and after data conversion

1Before converting

Keep the source file and confirm its encoding and data format.
Check whether the first row contains headers and whether field names look correct.
For personal or sensitive data, confirm where processing happens and who will receive the output.

2After converting

Use the preview to verify text, column names, and row counts.
Open the result in Excel or the destination system and check dates and long numbers.
Save the converted file under a new name so it can be compared with the source.

Common next steps

Fix CSV Encoding

Fix CSV character encoding before opening the data in Excel or continuing the workflow.

JSON to CSV

Turn JSON into a portable CSV for spreadsheets and downstream systems.

Parquet to CSV

Export Parquet data as CSV for quick inspection and easier sharing.

What is CloudTrail Log to CSV?

Expand CloudTrail Records into searchable columns for eventTime, eventSource, eventName, userIdentity, errors, and other audit fields.

Investigate multiple S3 log objects

This targets gzip-compressed JSON delivered by a CloudTrail trail to S3, rather than the recent-event CSV available in the console. Select multiple objects and merge them with a sourceFile column.

requestParameters and responseElements stay as JSON strings to avoid excessive columns, while userIdentity fields are expanded for filtering.

Fields prepared for review

eventTime, eventSource, and eventName
awsRegion and sourceIPAddress
userIdentity type, ARN, and principalId
errorCode and errorMessage
requestParameters and resources
Original log filename

CSV vs. JSONL

CSV

Best for filtering and reviewing audit events in a spreadsheet.

JSONL

Keeps one event per line for jq, DuckDB, and log pipelines.

How to use

1Choose one or more .json.gz objects from S3
2Click convert
3Review event and error columns
4Download CSV or JSONL

FAQ

Can it merge multiple .json.gz files?

Yes. Records from every selected file are merged and retain their source filename.

Is this for CloudTrail Lake exports?

It primarily targets the Records format delivered by trails to S3.

Are sensitive audit logs uploaded?

No. Decompression and conversion stay in your browser.

Related tools for the next step

DynamoDB JSON Converter Textract JSON to Excel S3 Inventory Viewer AWS export formats guide

Need help choosing the right workflow?

The guide section covers format differences, compression tips, and common PDF workflows.

Browse guides