# Logstash 2.4 - S3 output strange ${message} in file

**URL:** <https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059>\
**Category:** Logstash\
**Created:** [November 4, 2016, 8:34pm UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059 "2016-11-04T20:34:00Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![rbgeno7](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@rbgeno7](https://discuss.elastic.co/u/rbgeno7)\
**Post date:** [November 4, 2016, 8:34pm UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059/1 "2016-11-04T20:34:00Z")

</div>

Hi -

The S3 output seems to be working in that I'm getting messages, but instead of the parsed output I'm getting a message variable ${message}. This happens in both the temp location and in S3.

**Output -**  
root@ip-xx-xxx-xxx-xxx:/tmp/logstash# cat ls.s3.ip-xx-xxx-xxx-xxx.2016-11-04T20.30.part2.txt  
2016-11-04T20:30:27.373Z ip-xx-xxx-xxx-xxx %{message}

**Sample config section**  
s3 {  
bucket =\> "zz-test-bucket"  
prefix =\> "logstash/"  
region =\> "us-east-1"  
temporary\_directory =\> "/tmp/logstash"  
size\_file =\> 2048  
time\_file =\> 5  
}

Any thoughts on what I'm doing wrong?

Thanks,  
rg

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 8, 2016, 7:59pm UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059/2 "2016-11-08T19:59:46Z")

</div>

Do your events have a `message` field?

---

<div class="post-metadata">

**Author:** ![rbgeno7](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@rbgeno7](https://discuss.elastic.co/u/rbgeno7)\
**Post date:** [November 8, 2016, 9:07pm UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059/3 "2016-11-08T21:07:12Z")

</div>

No I remove that field after the grok filter.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 8, 2016, 9:38pm UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059/4 "2016-11-08T21:38:29Z")

</div>

Well, that certainly explains things. What do you want your S3 logs to look like?

---

<div class="post-metadata">

**Author:** ![rbgeno7](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@rbgeno7](https://discuss.elastic.co/u/rbgeno7)\
**Post date:** [November 8, 2016, 10:10pm UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059/5 "2016-11-08T22:10:26Z")

</div>

Actually, for now I'm just passing (or would like to) \_grokparsefailure logs to S3. The rest is going to kinesis and ES.

Json objects would be fine. Is this just a matter of changing the codec?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 8, 2016, 11:02pm UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059/6 "2016-11-08T23:02:21Z")

</div>

Yes, use the json\_lines codec.

---

<div class="post-metadata">

**Author:** ![rbgeno7](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@rbgeno7](https://discuss.elastic.co/u/rbgeno7)\
**Post date:** [November 9, 2016, 12:08am UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059/7 "2016-11-09T00:08:26Z")

</div>

that worked...thx.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059/8 "2017-07-06T04:30:42Z")

</div>