CloudTrail in AWS Module does not work when CloudTrail is enabled at Organization Level

[alaa-mallah]

Describe the enhancement:
Have the ability to specify a path for the CloudTrail S3 bucket

Describe a specific use case for the enhancement or feature:
If CloudTrail is enabled at the organization level, then the path structure would look like this:
"object.key": "AWSLogs//12345678910/CloudTrail/ap-southeast-2/2020/11/30/12345678910_CloudTrail_ap-southeast-2_20201130T1305Z_QuZ9yKG0lRw5wLmx.json.gz

However, filebeat is expecting different path structure:
"object.key": "AWSLogs/12345678910/CloudTrail/ap-southeast-2/2020/11/30/12345678910_CloudTrail_ap-southeast-2_20201130T1305Z_QuZ9yKG0lRw5wLmx.json.gz"

As a workaround, regex changed here, in order to parse the organization id folder in the s3 bucket

beats/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml

Lines 3 to 7 in 5d07709

	file_selectors:
	{{ if .process_cloudtrail_logs }}
	- regex: '^AWSLogs/\d+/CloudTrail/'
	expand_event_list_from_field: 'Records'
	{{ end }}

from: '^AWSLogs/\d+/CloudTrail/'
to: ^AWSLogs/\S+/\d+/CloudTrail/

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

This is similar to #23126 but the format of the path is different.

[andrewkroh]

The docs at https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-find-log-files.html indicate that the format is

bucket_name/prefix_name/AWSLogs/OU-ID/Account ID/CloudTrail/region/YYYY/MM/DD/file_name.json.gz

so that patterns we have need adapted to handle the optional OU-ID/ part.

I was playing with https://regex101.com/r/7WfOYY/2 as a quick test.