Logstash S3 input plugin - prefix wildcard

Elastic Stack Logstash
1

Hello,

we send logs from our ec2 instances to s3 buckets, to directories like i.e. "logs/name_of_the_server/2017/08/22/httpd/" where 20170822 is current day, httpd - name of the service from which we sent logs,

is it possible to configure input prefix like:
prefix => "logs/*/2017/08/22/httpd/" or prefix => "logs/asterisk/asterisk/asterisk/httpd/" (these configs not working for me)
so all the data from this date or all the data will be processed by Logstash?
Or we need data structure like:
"logs/httpd/name_of_the_server/date/" and then the prefix => "logs/httpd/"?

regards,
Lukasz

1 Like
2

I have this same issue. I have beanstalk logs going to /application/instance-id/ and the instance-id changes. I have been trying some variations with no success.
Sorry for not being of any help, just thought I'd let you know you're not alone lol.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.