# Logstash 2.3 S3 cloudtrail input

**URL:** <https://discuss.elastic.co/t/logstash-2-3-s3-cloudtrail-input/50782>\
**Category:** Logstash\
**Created:** [May 23, 2016, 11:53pm UTC](https://discuss.elastic.co/t/logstash-2-3-s3-cloudtrail-input/50782 "2016-05-23T23:53:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![redbeard](https://avatars.discourse-cdn.com/v4/letter/r/5f8ce5/32.png) [@redbeard](https://discuss.elastic.co/u/redbeard)\
**Post date:** [May 23, 2016, 11:53pm UTC](https://discuss.elastic.co/t/logstash-2-3-s3-cloudtrail-input/50782/1 "2016-05-23T23:53:31Z")

</div>

Hi All,

Hoping someone might be able to help me debug my logstash/S3/cloudtrail issue. This is my first time trying to set this up but I am not making any progress.

My setup :  
RHEL 7 logstash 2.3 running in AWS on EC2. My cloudtrail logs are in S3

# cat /etc/logstash/conf.d/cloudtrail.conf (keys have been removed)

input {  
s3 {  
bucket =\> "xyz\_cloudtrail"  
access\_key\_id =\> '.......'  
secret\_access\_key =\> '........'  
delete =\> false  
codec =\> cloudtrail {}  
interval =\> 10 # seconds  
region =\> "ap-southeast-2"  
}  
}

output {  
stdout { codec =\> cloudtrail }  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "cloudtrail"  
sniffing =\> true  
manage\_template =\> false  
}  
}

no idea if this is correct or not, can anyone advise ?

When I run ...  
/opt/logstash-2.3.2/bin/logstash --config /etc/logstash/conf.d/ -l /var/log/logstash/logstash.log --debug

i can see this message..

{:timestamp=\>"2016-05-24T09:51:02.716000+1000", :message=\> **"Connection refused", :class=\>"Manticore::SocketException"** , :backtrace=\>["/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/manticore-0.5.5-java/lib/manticore/response.rb:37:in `initialize'", "org/jruby/RubyProc.java:281:in`call'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/manticore-0.5.5-java/lib/manticore/response.rb:79:in `call'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/manticore-0.5.5-java/lib/manticore/response.rb:256:in`call\_once'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/manticore-0.5.5-java/lib/manticore/response.rb:153:in `code'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/http/manticore.rb:84:in`perform\_request'", "org/jruby/RubyProc.java:281:in `call'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/base.rb:257:in`perform\_request'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/http/manticore.rb:67:in `perform_request'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/sniffer.rb:32:in`hosts'", "org/jruby/ext/timeout/Timeout.java:147:in `timeout'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/sniffer.rb:31:in`hosts'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/base.rb:79:in `reload_connections!'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:72:in`sniff!'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/http\_client.rb:60:in `start_sniffing!'", "org/jruby/ext/thread/Mutex.java:149:in`synchronize'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/http\_client.rb:60:in `start_sniffing!'", "org/jruby/RubyKernel.java:1479:in`loop'", "/opt/logstash-2.3.2/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/http\_client.rb:59:in `start\_sniffing!'"], :level=\>:error}

Can anyone provide any assistance on where I am going wrong or what needs to be changed or how to troubleshoot this further ?

btw: I can download S3 logs manually using s3cmd so would think it's not a permission issue

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 25, 2016, 9:00am UTC](https://discuss.elastic.co/t/logstash-2-3-s3-cloudtrail-input/50782/2 "2016-05-25T09:00:59Z")

</div>

> [@redbeard](#):
>
> Connection refused

Looks like a networking issue to me, are you sure you have access?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/logstash-2-3-s3-cloudtrail-input/50782/3 "2017-07-06T04:56:20Z")

</div>