# Logstash S3 input plugin - prefix usage

**URL:** <https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-usage/255819>\
**Category:** Logstash\
**Created:** [November 18, 2020, 10:44am UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-usage/255819 "2020-11-18T10:44:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![david.preston](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@david.preston](https://discuss.elastic.co/u/david.preston)\
**Post date:** [November 18, 2020, 10:44am UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-usage/255819/1 "2020-11-18T10:44:59Z")

</div>

Hi - I'm using the logstash S3 input plugin - and need to implement "backup\_add\_prefix" - so that I can skip processed files - to improve performance.

I assumed the first step to implementing this, was to get the prefix option working.

All of the files in our S3 bucket have the same numeric prefix - however when I set this as the prefix

I get:  
No files found in bucket {:prefix=\>"123456789"}

I'm a bit confused how this prefix works - can some one tell me how it is intended to work - the docs say it is a filename prefix - but I have seen examples that look like people are using it as a path.

If it is a filename prefix, am I setting it wrong?

I would expect a prefix of 123456789 to match files that start with this  
i.e.  
123456789\_somefile.log  
123456789\_someotherfile.log

--Update--  
I've configured the prefix as a path (tried this previously, but found I had to remove the leading /) - and logstash is finding the files. However, this means that my use-case wont work.

I have found multiple discussions saying that the prefix is used to select the files, and the backup\_add\_prefix renames the files, so they wont be picked up by the prefix next interval.

Is this not the case?

Thanks  
Dave

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2020, 10:45am UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-usage/255819/2 "2020-12-16T10:45:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.