# S3 assets log **URL:** \ **Category:** Logstash\ **Created:** [August 18, 2016, 8:57pm UTC](https://discuss.elastic.co/t/s3-assets-log/58401 "2016-08-18T20:57:30Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![luisgzvs](https://avatars.discourse-cdn.com/v4/letter/l/85e7bf/32.png) [@luisgzvs](https://discuss.elastic.co/u/luisgzvs)\ **Post date:** [August 18, 2016, 8:57pm UTC](https://discuss.elastic.co/t/s3-assets-log/58401/1 "2016-08-18T20:57:30Z")
Hi guys, I need help with this topic, I have to analice assets\_logs from AWS bucket, I've dowloaded them to my local machine, but the problem is when I use this command to get @timestamp from log message, the log example is this one: ac4092fe3b00a5f6f84224f4694f4c46c9f2d147d9d97ddbe7aed04dfd9e99d [assets.quefilo.com](http://assets.quefilo.com) [26/Jul/2016:19:22:30 +0000] 10.144.195.181 3272ee65a908a7677109fedda345db8d9554ba26398b2ca10581de88777e2b61 F1B6D0C5B76FA4FF REST.PUT.OBJECT assets-logs/2016-07-26-19-22-30-B9BF0A5DF708F02A "PUT /assets.quefilo.com/assets-logs/2016-07-26-19-22-30-B9BF0A5DF708F02A HTTP/1.1" 200 - - 402 47 26 "-" "aws-internal/3" my configuration file: input { file { path =\> "/home/ubuntu/algunlado/\*" start\_position =\> beginning } } filter { grok { match =\> { "message" =\> "%{SYSLOG5424SD:logtimestamp}._%{IP} arn:aws:iam%{IP}._:user%{URIPATHPARAM} .\* %{JAVACLASS:method}"} } date { locale =\> "en" match =\> ["logtimestamp" , "dd/MMM/yyyy:HH:mm:ss Z"] } geoip { source =\> "clientip" } } output { elasticsearch { host =\> "localhost" protocol =\> http } } and I get this error from shell: Failed parsing date from field {:field=\>"logtimestamp", :value=\>"[29/Jul/2016:22:48:53 +0000]", :exception=\>java.lang.IllegalArgumentException: Invalid format: "[29/Jul/2016:22:48:53 +0000]", :level=\>:warn} My question is how can I get timestamp from the log information? thanks a lot! Regards! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 22, 2016, 10:57am UTC](https://discuss.elastic.co/t/s3-assets-log/58401/2 "2016-08-22T10:57:24Z")
The `logtimestamp` field begins and ends with a square brackets, but your date pattern doesn't. Hence use this date pattern. ``` match => ["logtimestamp" , "[dd/MMM/yyyy:HH:mm:ss Z]" ] ``` ---
**Author:** ![luisgzvs](https://avatars.discourse-cdn.com/v4/letter/l/85e7bf/32.png) [@luisgzvs](https://discuss.elastic.co/u/luisgzvs)\ **Post date:** [August 22, 2016, 8:05pm UTC](https://discuss.elastic.co/t/s3-assets-log/58401/3 "2016-08-22T20:05:02Z")
Thanks a lot magnus but the @timestamp field, don't get the date from my log information, with the configuration mentioned above, how can I get the date from the log information and then add it to the @timestamp field, so kibana will be able to recognize multiple dates, not just the one when I create de index. Regards! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 22, 2016, 8:20pm UTC](https://discuss.elastic.co/t/s3-assets-log/58401/4 "2016-08-22T20:20:43Z")
> the @timestamp field, don't get the date from my log information, with the configuration mentioned above Then I expect that you have an error message about this in your Logstash log. Also, please post an example of the event you get so that we can verify that the `logtimestamp` field exists and looks as expected. ---
**Author:** ![luisgzvs](https://avatars.discourse-cdn.com/v4/letter/l/85e7bf/32.png) [@luisgzvs](https://discuss.elastic.co/u/luisgzvs)\ **Post date:** [August 22, 2016, 9:09pm UTC](https://discuss.elastic.co/t/s3-assets-log/58401/5 "2016-08-22T21:09:02Z")
I use this command to run the logstash configuration file: sudo /opt/logstash/bin/logstash -f /etc/logstash/conf.d and I'm getting this error using that configuration: failed to open /home/ubuntu/algunlado/2016-07-22-14-31-54-99D064F24343B5BB: Permission denied - /home/ubuntu/algunlado/2016-07-22-14-31-54-99D064F24343B5BB {:level=\>:warn} Logstash shutdown completed Errno::EACCES: Permission denied - /home/ubuntu/.sincedb\_5d0efa804b3990eaec099d7dedce6fdf.28544.7215.954984 initialize at org/jruby/RubyFile.java:363 new at org/jruby/RubyIO.java:853 atomic\_write at /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/helper.rb:33 \_sincedb\_write at /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/tail.rb:234 sincedb\_write at /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/tail.rb:204 teardown at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-file-0.1.10/lib/logstash/inputs/file.rb:151 inputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:202 synchronize at org/jruby/ext/thread/Mutex.java:149 inputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:202 start\_input at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:170 but some index are being created: yellow open logstash-2016.07.27 5 1 1 0 7.8kb 7.8kb yellow open logstash-2016.08.22 5 1 521 0 372.9kb 372.9kb yellow open logstash-2016.07.29 5 1 100 0 94.6kb 94.6kb yellow open .kibana 1 1 1 0 3kb 3kb and in kibana logtimestamp isn't being recognized, ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f34cecb4cecf5240a227092014f0ecdad92cfa08.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2016, 5:31am UTC](https://discuss.elastic.co/t/s3-assets-log/58401/7 "2016-08-23T05:31:11Z")
Please don't post screenshots. Post text, either from Kibana's JSON tab or from Logstash's `stdout { codec => rubydebug }` output.. Format the text as code with the `` toolbar button. Now, the `_grokparsefailure` tag in what you posted indicates that there is no `logtimestamp` field because the grok filter failed. Address that first. You should also address this: > failed to open /home/ubuntu/algunlado/2016-07-22-14-31-54-99D064F24343B5BB: Permission denied - /home/ubuntu/algunlado/2016-07-22-14-31-54-99D064F24343B5BB {:level=\>:warn} ---
**Author:** ![luisgzvs](https://avatars.discourse-cdn.com/v4/letter/l/85e7bf/32.png) [@luisgzvs](https://discuss.elastic.co/u/luisgzvs)\ **Post date:** [August 23, 2016, 3:10pm UTC](https://discuss.elastic.co/t/s3-assets-log/58401/8 "2016-08-23T15:10:23Z")
I'm sorry for my ignorance, but what do you mean with address this? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2016, 5:35pm UTC](https://discuss.elastic.co/t/s3-assets-log/58401/9 "2016-08-23T17:35:14Z")
I mean "fix it". Fix the bad grok expression and fix the file permission problem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/s3-assets-log/58401/10 "2017-07-06T04:42:00Z")