# Logstash s3 output
**URL:** https://discuss.elastic.co/t/logstash-s3-output/311118
**Category:** Logstash
**Created:** [August 1, 2022, 1:09pm UTC](https://discuss.elastic.co/t/logstash-s3-output/311118 "2022-08-01T13:09:41Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)
#### Post date: [August 1, 2022, 1:09pm UTC](https://discuss.elastic.co/t/logstash-s3-output/311118/1 "2022-08-01T13:09:41Z")
My logstash s3 output is not working as defined in the pipeline config. The exact output config is working for other pipelines. The dynamic directory structure(/syslog/%{+YYYY}/%{+MM}/%{+dd}/%{+HH}) defined in the config is not created.
The expected directory structure "s3://my-s3-bucket/syslog/2022/08/12/filename.txt.gz".
What I see in the s3 is "s3://my-s3-bucket/syslog////filename.txt.gz"
output:
```auto
output {
s3 {
id => "syslog_id"
bucket => "my-s3-bucket"
prefix => "/syslog/%{+YYYY}/%{+MM}/%{+dd}/%{+HH}"
temporary_directory => "/app/syslog_temp"
encoding => "gzip"
codec => json_lines
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 1, 2022, 1:15pm UTC](https://discuss.elastic.co/t/logstash-s3-output/311118/2 "2022-08-01T13:15:25Z")
Have you removed the [@timestamp] field from your events?
---
### Author:  [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)
#### Post date: [August 1, 2022, 1:20pm UTC](https://discuss.elastic.co/t/logstash-s3-output/311118/3 "2022-08-01T13:20:08Z")
yes... I see it is repeating field from the syslog header.
```auto
mutate {
remove_field => ["@timestamp"]
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 1, 2022, 2:11pm UTC](https://discuss.elastic.co/t/logstash-s3-output/311118/4 "2022-08-01T14:11:07Z")
> [@Giridharan\_C](#):
>
> `%{+YYYY}/%{+MM}/%{+dd}/%{+HH}`
Those are expanded using the [@timestamp] field. If the field does not exist then they will be empty strings.
---
### Author:  [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)
#### Post date: [August 2, 2022, 8:59am UTC](https://discuss.elastic.co/t/logstash-s3-output/311118/5 "2022-08-02T08:59:12Z")
> [@Badger](#):
>
> Those are expanded using the [@timestamp] field. If the field does not exist then they will be empty strings.
Thank you @Badger. Now the config is working as defined.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2022, 8:59am UTC](https://discuss.elastic.co/t/logstash-s3-output/311118/6 "2022-08-30T08:59:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.