# Does logstash support zip format logs from s3 bucket

**URL:** <https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877>\
**Category:** Logstash\
**Created:** [October 18, 2022, 10:58am UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877 "2022-10-18T10:58:54Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [October 18, 2022, 10:58am UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/1 "2022-10-18T10:58:54Z")

</div>

Hi Team,

Just want to know does logstash support the integration of logs from s3 bucket which are in .zip format?

Regards

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 18, 2022, 11:15am UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/2 "2022-10-18T11:15:04Z")

</div>

According to [docs](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-s3.html),yes

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [October 18, 2022, 11:30am UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/3 "2022-10-18T11:30:58Z")

</div>

Hi @Rios

we are facing issue

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/8348eb98592ede9a2463587527dba8e8373de7af.jpeg)

> [@Processing remote ZIP files with Logstash](https://discuss.elastic.co/t/processing-remote-zip-files-with-logstash/120254/3):
>
> I don't have any codec currently specified though. Just a simple config with http\_poller set on a cron and a file output location.

Need some confirmation

Regards

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 18, 2022, 11:33am UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/4 "2022-10-18T11:33:32Z")

</div>

The documentation is for input s3 plugin not http\_poller. Use s3 plugin.

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [October 18, 2022, 11:36am UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/5 "2022-10-18T11:36:43Z")

</div>

But i am getting the above error

Regards  
Shrikant

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [October 18, 2022, 11:45am UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/6 "2022-10-18T11:45:54Z")

</div>

Hi @Rios ,

Any advise please

Warm Regards

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [October 18, 2022, 11:55am UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/7 "2022-10-18T11:55:11Z")

</div>

this is my input config

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f2f0579b9f6147aef96388b475890bc23b287d4d.jpeg)  
don't know why not able to pull.

Regards  
Shrikant

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 18, 2022, 6:20pm UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/8 "2022-10-18T18:20:38Z")

</div>

I haven't try, however this might help:  
`gzip_pattern >= ".*?$"`  
or zip restrictive:  
`gzip_pattern >= "\.zip$"`

#### `gzip_pattern`

- Value type is [string](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-s3.html#plugins-inputs-s3-gzip_pattern)\*
- Default value is `"\.gz(ip)?$"`\*

_Regular expression used to determine whether an input file is in gzip format._

If doesn't work, enable debug level in LS, and copy text log not as a pic, maybe someone from Elastic team might have an additional idea.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2022, 6:20pm UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877/9 "2022-11-15T18:20:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
