# About AWS S3 Input
**URL:** https://discuss.elastic.co/t/about-aws-s3-input/297922
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [February 22, 2022, 3:40pm UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922 "2022-02-22T15:40:44Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@dawiro](https://discuss.elastic.co/u/dawiro)
#### Post date: [February 22, 2022, 3:40pm UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922/1 "2022-02-22T15:40:44Z")
Hi,
We're considering changes to the structure of our ingestion pipelines. One of those is to have dockerized services write their logs to s3 and then have filebeat read them back before forwarding.
Given that we have apps whose logs get split by docker would this work? Would filebeat be able to stitch logs back together which have been split by docker before being written to s3?
Thx
D
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [February 23, 2022, 4:36am UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922/2 "2022-02-23T04:36:25Z")
Do u have an example? What do u mean by split?
---
### Author:  [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)
#### Post date: [February 24, 2022, 4:38pm UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922/3 "2022-02-24T16:38:28Z")
I'm also a bit confused by this "split" and "stitch together". Could you elaborate more on this, maybe provide some examples.
Here are some high level ideas:
If the logs have got some common fields, like the application name you can filter using those fields. Another option would be to add some extra [fileds when reading the S3 files](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html#filebeat-input-aws-s3-fields).
---
### Author:  [@dawiro](https://discuss.elastic.co/u/dawiro)
#### Post date: [February 25, 2022, 10:41am UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922/4 "2022-02-25T10:41:21Z")
Hi,
I'm referring to the 16KB log line limit in docker. As we have apps which write a heavy payload we need to be able to recombine those messages.
Thx
D
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [February 27, 2022, 6:41am UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922/5 "2022-02-27T06:41:43Z")
Interesting. No filebeat has no way to combine multiple events into a single one. You'd have to use logstash probably to do that using memcache or something similar to store the intermediate data.
---
### Author:  [@dawiro](https://discuss.elastic.co/u/dawiro)
#### Post date: [March 1, 2022, 4:02pm UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922/6 "2022-03-01T16:02:33Z")
Well, filebeat can do it when docker writes to json files. It's unfortunate that this capability (recombine docker log messages) is only implemented in the docker input.
How the equivalent could be done in logstash isn't clear to me.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2022, 6:02pm UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922/7 "2022-03-29T18:02:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.