# Logstash S3 input

**URL:** <https://discuss.elastic.co/t/logstash-s3-input/304118>\
**Category:** Logstash\
**Created:** [May 6, 2022, 11:26am UTC](https://discuss.elastic.co/t/logstash-s3-input/304118 "2022-05-06T11:26:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivendra95](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@shivendra95](https://discuss.elastic.co/u/shivendra95)\
**Post date:** [May 6, 2022, 11:26am UTC](https://discuss.elastic.co/t/logstash-s3-input/304118/1 "2022-05-06T11:26:24Z")

</div>

Hi there,  
I'm trying to use the logstash S3 input plugin to fetch logs from S3 bucket.

This is my input

```auto
s3 {
    id => "terminal_app"
    access_key_id => "${access_key_id}"
    secret_access_key => "${secret_access_key}"
    bucket => "logstash-sb"
    region => "ap-south-1"
    codec => json
    additional_settings => {
          force_path_style => true
          follow_redirects => false
        }
  
  }

```

This is my output plugin

```auto
  else if [@metadata][s3][id] == "terminal_app" {
     elasticsearch {
       hosts => ["localhost:9200"]
       index => "terminal_app_index"
       user => "elastic"
       password => "${es_pwd}"    

     }
   }

```

I want to write the logs fetched from S3 to a particular index  
Is this way that I'm currenty doing the right way because the connection has been made with S3 as I did not encounter any error but there was nothing written in the index that I mentioned in output plugin.

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 6, 2022, 1:44pm UTC](https://discuss.elastic.co/t/logstash-s3-input/304118/2 "2022-05-06T13:44:46Z")

</div>

Hi,

we can't make assumptions without a full file.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 6, 2022, 4:37pm UTC](https://discuss.elastic.co/t/logstash-s3-input/304118/3 "2022-05-06T16:37:06Z")

</div>

> [@shivendra95](#):
>
> there was nothing written in the index that I mentioned in output plugin.

What versions of logstash and elasticsearch are you using? In recent versions the index option is ignored because [ILM](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm) is enabled if supported.

---

<div class="post-metadata">

**Author:** ![shivendra95](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@shivendra95](https://discuss.elastic.co/u/shivendra95)\
**Post date:** [May 9, 2022, 7:34am UTC](https://discuss.elastic.co/t/logstash-s3-input/304118/4 "2022-05-09T07:34:07Z")

</div>

I found the issue, it was in my conditional statement for S3, I tried with

```auto
  else if [type] == "s3" 

```

instead of

```auto
else if [@metadata][s3][id] == "terminal_app"

```

After doing the above change, it was working fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2022, 7:34am UTC](https://discuss.elastic.co/t/logstash-s3-input/304118/5 "2022-06-06T07:34:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.