Logstash: s3 input plugin

Hello, I am to work on a use case of ingesting aws cloud trail logs from a s3 bucket into logstash.

  • A number of logstash servers are spun by the auto scaling group
  • Do I need to apply s3 input config to every one of them as bootstrap config ?
  • If so, will several logstash servers work to digest files from s3 ? could this result into duplicate entries in elasticsearch ?
  • Or is there a better way to push config to servers, auto magically ?

thank you, and I look forward to advise.

Best regards

Logstash's s3 input has no support for multiple instances pulling logs from the same bucket.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.