Thanks for a great tool!
When creating a trail, using an existing S3 bucket, you have the option of specifying a prefix.
This prefix shows up in the Cloudtrail -> Trails tab under the table header "Log file prefix".
Currently, trail-digger does not support prefixes.
Also, the events output is missing a few essential properties. Things like the error code and error message.
It would be an easy fix to add looking at the code and I would be happy to create a pull-request for it. Interested?