# Filebeat AWS Module unable to process Logs from S3
**URL:** https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [June 10, 2021, 7:49pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616 "2021-06-10T19:49:08Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@vishakh](https://discuss.elastic.co/u/vishakh)
#### Post date: [June 10, 2021, 7:49pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616/1 "2021-06-10T19:49:08Z")
ELK-Stack: 7.11.2 and Filebeat: 7.11.2
Up until today, Filebeat-AWS Module was able to read messages(vpc logs) from sqs queue. But, of of no-where, I see filebeat is unable to process the vpc-logs. I’m seeing the below error in the filebeat logs
```auto
{"log.level":"error","@timestamp":"2021-06-10T19:16:49.147Z","log.logger":"input.s3","log.origin":{"file.name":"s3/collector.go","file.line":389},"message":"readStringAndTrimDelimiter failed: context deadline exceeded","queue_url":"SQS-Queue_URL","region":"us-east-1","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-06-10T19:16:49.148Z","log.logger":"input.s3","log.origin":{"file.name":"s3/collector.go","file.line":304},"message":"createEventsFromS3Info failed processing file from s3 bucket \"BUCKET-NAME\" with name \"AWSLogs/xxxxxx/vpcflowlogs/us-east-1/2021/06/10/xxxxxxx_vpcflowlogs_us-east-1_fl-0f728d964f22ff25f_20210610T1345Z_ea3fd52f.log.gz\": context deadline exceeded","queue_url":"SQS-Queue_URL","region":"us-east-1","ecs.version":"1.6.0"}
```
---
### Author:  [@vishakh](https://discuss.elastic.co/u/vishakh)
#### Post date: [June 10, 2021, 7:50pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616/2 "2021-06-10T19:50:28Z")
On S3 bucket the Metadata is: `Content-Type: application/x-gzip`
---
### Author:  [@vishakh](https://discuss.elastic.co/u/vishakh)
#### Post date: [June 10, 2021, 7:51pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616/3 "2021-06-10T19:51:00Z")
Filebeat AWS Config is as below:
```auto
- module: aws
vpcflow:
enabled: true
var.queue_url: SQS-Queue_URL
var.credential_profile_name: xxxx
var.api_timeout: 120s
var.endpoint: amazonaws.com
var.role_arn:
```
---
### Author:  [@vishakh](https://discuss.elastic.co/u/vishakh)
#### Post date: [June 14, 2021, 3:19pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616/4 "2021-06-14T15:19:35Z")
@legoguy1000@Kaiyan_Sheng Can you please review & suggest on the issue above.
Any help/review would be great!
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [June 14, 2021, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616/5 "2021-06-14T15:36:44Z")
Unfortunately that one IDK. Maybe the issue is the `Content-Type: application/x-gzip`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2021, 5:37pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616/6 "2021-07-12T17:37:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.