Logstash s3 output

[Giridharan_C]

My logstash s3 output is not working as defined in the pipeline config. The exact output config is working for other pipelines. The dynamic directory structure(/syslog/%{+YYYY}/%{+MM}/%{+dd}/%{+HH}) defined in the config is not created.
The expected directory structure "s3://my-s3-bucket/syslog/2022/08/12/filename.txt.gz".
What I see in the s3 is "s3://my-s3-bucket/syslog////filename.txt.gz"

output:

output {
  s3 {
    id => "syslog_id"
    bucket => "my-s3-bucket"
    prefix => "/syslog/%{+YYYY}/%{+MM}/%{+dd}/%{+HH}"
    temporary_directory => "/app/syslog_temp"
    encoding => "gzip"
    codec => json_lines
  }
}

[Badger]

Have you removed the [@timestamp] field from your events?

[Giridharan_C]

yes... I see it is repeating field from the syslog header.

mutate {
                remove_field => ["@timestamp"]
        }

[Badger]

@Giridharan_C

%{+YYYY}/%{+MM}/%{+dd}/%{+HH}

Those are expanded using the [@timestamp] field. If the field does not exist then they will be empty strings.

[Giridharan_C]

@Badger

Those are expanded using the [@timestamp] field. If the field does not exist then they will be empty strings.

Thank you @Badger. Now the config is working as defined.