# Logstash.inputs.s3 failed fetching events from S3

**URL:** <https://discuss.elastic.co/t/logstash-inputs-s3-failed-fetching-events-from-s3/143421>\
**Category:** Logstash\
**Created:** [August 8, 2018, 4:03am UTC](https://discuss.elastic.co/t/logstash-inputs-s3-failed-fetching-events-from-s3/143421 "2018-08-08T04:03:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lcui\_dxc](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\
**Post date:** [August 8, 2018, 4:03am UTC](https://discuss.elastic.co/t/logstash-inputs-s3-failed-fetching-events-from-s3/143421/1 "2018-08-08T04:03:59Z")

</div>

Hello there,

I set up the logstash s3 input plugin to fetch event/logs from CloudTrail logs on S3.  
The following error filled in the logstash plain log:

# ========================= ... [2018-08-08T03:40:22,523][INFO][org.logstash.beats.Server] Starting server on port: 5044 [2018-08-08T03:40:22,593][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>[]} [2018-08-08T03:40:23,009][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2018-08-08T03:40:25,084][INFO][logstash.inputs.s3] Using default generated file for the sincedb {:filename=\>"/var/lib/logstash/plugins/inputs/s3/sincedb\_77d547f7f2589dd0e256b37dfde58574"} [2018-08-08T03:40:29,068][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}) [2018-08-08T03:40:29,071][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}) ....

I can see an index with name "%{[@metadata][beat]}-%{[@metadata][version]}-2018.08.07" there but can not delete it....  
Here is my configuration file:

==========================  
input {  
beats {  
port =\> 5044  
}  
s3 {  
access\_key\_id =\> "12345"  
secret\_access\_key =\> "678910"  
region =\> "us-east-1"  
bucket =\> "aaa-apaas-bbb-cloudtrail"  
prefix =\> "AWSLogs/000000000/CloudTrail/us-east-1/2018/08/"  
#storage\_class =\> standard  
codec =\> "json"  
}  
}

# The filter part of this file is commented out to indicate that it

# is optional.

# filter {

# 

# }

# output { elasticsearch { action =\> "index" hosts =\> ["xx.xxx.xx.xx"] manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } s3 { access\_key\_id =\> "12345" secret\_access\_key =\> "678910" region =\> "us-east-1" bucket =\> "bucket-name" } }

Please help.

Thank you very much.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 8, 2018, 5:56am UTC](https://discuss.elastic.co/t/logstash-inputs-s3-failed-fetching-events-from-s3/143421/2 "2018-08-08T05:56:03Z")

</div>

> [2018-08-08T03:40:29,071][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})

The index is read-only, possibly because the cluster is in a bad shape. Focus your attention on that, not on your s3 input.

> index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

Since your data source isn't beats the metadata fields referenced here won't exist so you won't end up with the index name you expect.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 8, 2018, 6:57am UTC](https://discuss.elastic.co/t/logstash-inputs-s3-failed-fetching-events-from-s3/143421/3 "2018-08-08T06:57:01Z")

</div>

> [@lcui\_dxc](#):
>
> [2018-08-08T03:40:29,068][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})

This can often indicate that you are running out of disk space in your Elasticsearch cluster and have reached [a high watermark](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/disk-allocator.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2018, 6:57am UTC](https://discuss.elastic.co/t/logstash-inputs-s3-failed-fetching-events-from-s3/143421/4 "2018-09-05T06:57:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.