Logstash: s3 input plugin

Elastic Stack Logstash
1

Hello, I am to work on a use case of ingesting aws cloud trail logs from a s3 bucket into logstash.

  • A number of logstash servers are spun by the auto scaling group
  • Do I need to apply s3 input config to every one of them as bootstrap config ?
  • If so, will several logstash servers work to digest files from s3 ? could this result into duplicate entries in elasticsearch ?
  • Or is there a better way to push config to servers, auto magically ?

thank you, and I look forward to advise.

Best regards

2

Logstash's s3 input has no support for multiple instances pulling logs from the same bucket.