# Logstash output to AWS S3 bucket not working

**URL:** <https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398>\
**Category:** Logstash\
**Created:** [April 14, 2016, 2:20pm UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398 "2016-04-14T14:20:26Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![rains555](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@rains555](https://discuss.elastic.co/u/rains555)\
**Post date:** [April 14, 2016, 2:20pm UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398/1 "2016-04-14T14:20:26Z")

</div>

Hi,  
I've tried a couple different ways to output data to an S3 bucket on Amazon. I followed the documentation for output plug-ins to s3 but the function is not working. any suggestions please?  
filter { }  
output {  
stdout {  
codec =\> dots  
}  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "twitter"  
document\_type =\> "tweets"  
template =\> "D:/Downloads/datasets/iot/twitter\_template.json"  
template\_name =\> "twitter\_example"  
template\_overwrite =\> true  
}  
file {  
path =\> "D:/Downloads/datasets/twitter\_iot/twitter.csv"  
}  
s3 {  
credentials =\> ["accessKeyID", "SecretKeyID"]  
access\_key\_id =\> "accessKeyID"  
secret\_access\_key =\> "SecretKeyID"  
region =\> “us-west-2”  
bucket =\> “s3://mybucket/path”  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 18, 2016, 9:06pm UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398/2 "2016-04-18T21:06:03Z")

</div>

Have you checked the Logstash logs for clues?

---

<div class="post-metadata">

**Author:** ![davidweir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidweir/32/9678_2.png) [@davidweir](https://discuss.elastic.co/u/davidweir)\
**Post date:** [May 9, 2016, 10:57pm UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398/3 "2016-05-09T22:57:53Z")

</div>

I'm trying to do a similar thing, but using environment variables for the access & secret keys. I get this error in response:  
"{:timestamp=\>"2016-05-09T15:58:41.247000-0700", :message=\>"S3: AWS error", :error=\>#AWS::S3::Errors::InvalidAccessKeyId: The AWS Access Key Id you provided does not exist in our records.\>, :level=\>:error}"

the entry in my output.conf file is:  
output {  
s3 {  
access\_key\_id =\> "${AWS\_ACCESS\_KEY}"  
secret\_access\_key =\> "${AWS\_SECRET\_KEY}"  
}  
}

is the s3 output plugin not handling environment variables?

---

<div class="post-metadata">

**Author:** ![davidweir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidweir/32/9678_2.png) [@davidweir](https://discuss.elastic.co/u/davidweir)\
**Post date:** [May 9, 2016, 11:01pm UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398/4 "2016-05-09T23:01:20Z")

</div>

looks like I need to add the "--allow-env" flag to running logstash to make this work. I'll try adding the flag and let you know.

---

<div class="post-metadata">

**Author:** ![davidweir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidweir/32/9678_2.png) [@davidweir](https://discuss.elastic.co/u/davidweir)\
**Post date:** [May 9, 2016, 11:18pm UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398/5 "2016-05-09T23:18:55Z")

</div>

Ok, got the env vars working, now have this error:  
{:timestamp=\>"2016-05-09T16:17:29.026000-0700", :message=\>"S3: AWS error", :error=\>#AWS::S3::Errors::PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.\>, :level=\>:error}

what does this mean and how is it rectified?

---

<div class="post-metadata">

**Author:** ![davidweir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidweir/32/9678_2.png) [@davidweir](https://discuss.elastic.co/u/davidweir)\
**Post date:** [May 9, 2016, 11:30pm UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398/6 "2016-05-09T23:30:13Z")

</div>

> [@davidweir](#):
>
> he bucket you are attempting to access must be addressed using the specified endpoint

Ok. Fixed this by removing the "region" option from s3 config. Now have to figure out why my log files on s3 are filled with this line:  
 %{host} %{message}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2016, 6:24am UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398/7 "2016-05-10T06:24:18Z")

</div>

> Now have to figure out why my log files on s3 are filled with this line:  
> %{host} %{message}

Please start a new thread for that question, if necessary.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398/8 "2017-07-06T04:58:25Z")

</div>


