# Logstash s3 input plugin failed to work with subdirectories

**URL:** <https://discuss.elastic.co/t/logstash-s3-input-plugin-failed-to-work-with-subdirectories/117220>\
**Category:** Logstash\
**Created:** [January 26, 2018, 3:57pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-failed-to-work-with-subdirectories/117220 "2018-01-26T15:57:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikolay\_Petrov](https://avatars.discourse-cdn.com/v4/letter/n/4af34b/32.png) [@Nikolay\_Petrov](https://discuss.elastic.co/u/Nikolay_Petrov)\
**Post date:** [January 26, 2018, 3:57pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-failed-to-work-with-subdirectories/117220/1 "2018-01-26T15:57:57Z")

</div>

Hi,  
I'm observing an couple of difficulties, until trying to grab the data from s3, if they stored on that way:

> trailbucketname/usw1/AWSLogs/361190373704/CloudTrail/us-west-1////361190373704\_CloudTrail\_us-west-1\_\*.json.gz

the question is: is the provided option from s3 input logstash plugin are enough to match the following path, or it's impossible currently to work suggested schema?

my config is:

> input{  
> s3 {  
> access\_key\_id =\> "..."  
> bucket =\> "trailbucketname"  
> region =\> "us-west-1"  
> secret\_access\_key =\> "..."  
> prefix =\> "usw1/_/_/_/_/_/_/\*/"  
> }  
> }  
> output{  
> stdout {  
> codec =\> rubydebug  
> }

, and verbosity does not show any visible error:

> [2018-01-26T15:52:52,048][INFO][logstash.inputs.s3] Registering s3 input {:bucket=\>"trailbucketname", :region=\>"us-west-1"}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2018, 3:58pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-failed-to-work-with-subdirectories/117220/2 "2018-02-23T15:58:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.