# Logstash gives: Unknown setting '"bucket"' for s3 error **URL:** \ **Category:** Logstash\ **Created:** [June 26, 2019, 11:54am UTC](https://discuss.elastic.co/t/logstash-gives-unknown-setting-bucket-for-s3-error/187559 "2019-06-26T11:54:39Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![K\_B1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/k_b1/32/48063_2.png) [@K\_B1](https://discuss.elastic.co/u/K_B1)\ **Post date:** [June 26, 2019, 11:54am UTC](https://discuss.elastic.co/t/logstash-gives-unknown-setting-bucket-for-s3-error/187559/1 "2019-06-26T11:54:39Z")
**Referring to:** [Security for Elasticsearch is now free | Elastic Blog](https://www.elastic.co/blog/security-for-elasticsearch-is-now-free?ultron=may-2019&blade=newsletter&hulk=email&mkt_tok=eyJpIjoiWlRNM1lqY3dNbVV5TlRVdyIsInQiOiJjV2VrU29zeXR1MG5OWGNzMGNrYjRmdW1DODBReDF1T21pemZ5eDNSYnJxTmVnR05VY0FOS1N5ZFZ6Z3JraXVSYVwvNFV0c2VWSDBRckhwYnZmc3BxUXFyZytkWjRpbTFKSXdPb0JwVnROa3NleEkyK2lZcHRYWnlUZ1hyOHIyRjkifQ%3D%3D) - In order to get role-based access control, I upgraded my ELK stack from 6.8.1 to 7.1.1, though it should run on 6.8.1 also. - I followed [Secure Elasticsearch with TLS encryption and role-based access control | Elastic Blog](https://www.elastic.co/blog/getting-started-with-elasticsearch-security) - Elasticsearch & Kibana is running properly. - I configured logstash.conf to get input from s3 and ship to logstash (please note that this configuration was running successfully with 6.8.1) * * * - Logstash.conf has: > input { > s3 { > "access\_key\_id" =\> "_**" > "secret\_access\_key" =\> "**_" > "bucket" =\> "bucket\_name" > "region" =\> "region" > "prefix" =\> "my\_prefix/" > "type" =\> "type1" > } > } > > filter { > if [type] == "type1" { > grok { > match =\> { > "message" =\> "[%{TIMESTAMP\_ISO8601:time}.\*] [%{NUMBER:pid}] [%{WORD:severity}] %{GREEDYDATA:log}" > } > } > } > } > output { > if [type] == "type1" { > elasticsearch { > hosts =\> ["my\_ip:9200"] > manage\_template =\> false > index =\> "type1-%{+YYYY.MM.dd}" > } - My pipelines.yml has: > - pipeline.id: logstash > path.config: "/home/ubuntu/logstash-7.1.1/config/logstash.conf" Facing following error, attached the screenshot. > ./bin/logstash > OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. > > WARNING: An illegal reflective access operation has occurred > WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/home/ubuntu/logstash-7.1.1/logstash-core/lib/jars/jruby-complete-9.2.7.0.jar) to field java.io.FileDescriptor.fd > WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules > WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations > WARNING: All illegal access operations will be denied in a future release > > Sending Logstash logs to /home/ubuntu/logstash-7.1.1/logs which is now configured via log4j2.properties > [2019-06-26T11:19:00,332][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.1.1"} > [2019-06-26T11:19:26,673][ERROR][logstash.inputs.s3] **Unknown setting '"bucket"' for s3** > [2019-06-26T11:19:26,675][ERROR][logstash.inputs.s3] **Unknown setting '"additional\_settings"' for s3** > [2019-06-26T11:19:26,675][ERROR][logstash.inputs.s3] **Unknown setting '"access\_key\_id"' for s3** > [2019-06-26T11:19:26,676][ERROR][logstash.inputs.s3] **Unknown setting '"type"' for s3** > [2019-06-26T11:19:26,677][ERROR][logstash.inputs.s3] **Unknown setting '"prefix"' for s3** > [2019-06-26T11:19:26,677][ERROR][logstash.inputs.s3] **Unknown setting '"region"' for s3** > [2019-06-26T11:19:26,678][ERROR][logstash.inputs.s3] **Unknown setting '"secret\_access\_key"' for s3** > [2019-06-26T11:19:26,700][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:logstash, :exception=\>"LogStash::ConfigurationError", :message=\>"Something is wrong with your configuration.", :backtrace=\>["/home/ubuntu/logstash-7.1.1/logstash-core/lib/logstash/config/mixin.rb:86:in `config_init'", "/home/ubuntu/logstash-7.1.1/logstash-core/lib/logstash/inputs/base.rb:60:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:255:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:117:in `buildInput'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/home/ubuntu/logstash-7.1.1/logstash-core/lib/logstash/java_pipeline.rb:23:in `initialize'", "/home/ubuntu/logstash-7.1.1/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/home/ubuntu/logstash-7.1.1/logstash-core/lib/logstash/agent.rb:325:in `block in converge\_state'"]} > [2019-06-26T11:19:27,303][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} > [2019-06-26T11:19:32,039][INFO][logstash.runner] Logstash shut down. > **strong text** ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 26, 2019, 12:53pm UTC](https://discuss.elastic.co/t/logstash-gives-unknown-setting-bucket-for-s3-error/187559/2 "2019-06-26T12:53:26Z")
Remove the quotes around the names of the options it should be ``` bucket => "bucket_name" ``` ---
**Author:** ![K\_B1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/k_b1/32/48063_2.png) [@K\_B1](https://discuss.elastic.co/u/K_B1)\ **Post date:** [June 26, 2019, 2:10pm UTC](https://discuss.elastic.co/t/logstash-gives-unknown-setting-bucket-for-s3-error/187559/3 "2019-06-26T14:10:20Z")
Hey Badger, I removed the quotes, and now facing this error when I start the logstash. > Starting Logstash {"logstash.version"=\>"7.1.1"} > > [2019-06-26T14:06:40,162][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://logstash\_system:xxxxxx@127.0.0.1:9200/](http://logstash_system:xxxxxx@127.0.0.1:9200/)]}} > [2019-06-26T14:06:40,779][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[http://logstash\_system:xxxxxx@127.0.0.1:9200/](http://logstash_system:xxxxxx@127.0.0.1:9200/)"} > [2019-06-26T14:06:41,086][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>7} > [2019-06-26T14:06:41,099][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>7} > [2019-06-26T14:06:41,188][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[http://127.0.0.1:9200](http://127.0.0.1:9200)"]} > **warning: thread "Ruby-0-Thread-5: :1" terminated with exception (report\_on\_exception is true):** > **\> LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError: Got response code '403' contacting Elasticsearch at URL '[http://127.0.0.1:9200/logstash](http://127.0.0.1:9200/logstash)'** > perform\_request at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:80 > perform\_request\_to\_url at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:291 > perform\_request at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:278 > with\_connection at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:373 > perform\_request at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:277 > Pool at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:285 > exists? at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:341 > rollover\_alias\_exists? at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:359 > maybe\_create\_rollover\_alias at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/ilm.rb:91 > setup\_ilm at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/ilm.rb:10 > setup\_after\_successful\_connection at /home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:52 > [2019-06-26T14:06:41,645][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\, :backtrace=\>["/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:80:in `perform_request'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in `perform\_request\_to\_url'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:278:in `block in perform_request'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in `with\_connection'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:277:in `perform_request'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in `block in Pool'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:341:in `exists?'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:359:in `rollover\_alias\_exists?'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/ilm.rb:91:in `maybe_create_rollover_alias'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/ilm.rb:10:in `setup\_ilm'", "/home/ubuntu/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:52:in `block in setup\_after\_successful\_connection'"]} > [2019-06-26T14:06:41,897][INFO][logstash.javapipeline] Starting pipeline {:pipeline\_id=\>"logstash", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>250, :thread=\>"#\"} > [2019-06-26T14:06:41,898][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 26, 2019, 2:12pm UTC](https://discuss.elastic.co/t/logstash-gives-unknown-setting-bucket-for-s3-error/187559/4 "2019-06-26T14:12:32Z")
> [@K\_B1](#): > > LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError: Got response code '403' contacting Elasticsearch at URL '[http://127.0.0.1:9200/logstash](http://127.0.0.1:9200/logstash)' 403 is 'Forbidden'. Sounds like you need to supply a username and password to the elasticsearch filter. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 24, 2019, 2:12pm UTC](https://discuss.elastic.co/t/logstash-gives-unknown-setting-bucket-for-s3-error/187559/5 "2019-07-24T14:12:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.