# S3 Input not working

**URL:** https://discuss.elastic.co/t/s3-input-not-working/58267
**Category:** Logstash
**Created:** [August 17, 2016, 2:52pm UTC](https://discuss.elastic.co/t/s3-input-not-working/58267 "2016-08-17T14:52:12Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Zorlin](https://avatars.discourse-cdn.com/v4/letter/z/b782af/32.png) [@Zorlin](https://discuss.elastic.co/u/Zorlin)
#### Post date: [August 17, 2016, 2:52pm UTC](https://discuss.elastic.co/t/s3-input-not-working/58267/1 "2016-08-17T14:52:12Z")

</div>

Hey there,

We have a Logstash setup processing a bunch of different inputs successfully.

Unfortunately, the S3 input is not working.

Here is the current config I'm working with:

input {  
s3 {  
bucket =\> "production-logs-elb"  
region =\> "ap-southeast-2"  
type =\> "prod-elb"  
prefix =\> "AWSLogs/481913130099/elasticloadbalancing/ap-southeast-2/"  
}  
}

Logstash doesn't seem to be logging any errors.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 17, 2016, 10:35pm UTC](https://discuss.elastic.co/t/s3-input-not-working/58267/2 "2016-08-17T22:35:36Z")

</div>

> [@Zorlin](#):
>
> Unfortunately, the S3 input is not working.

What does that mean exactly?

---

<div class="post-metadata">

### Author: ![Zorlin](https://avatars.discourse-cdn.com/v4/letter/z/b782af/32.png) [@Zorlin](https://discuss.elastic.co/u/Zorlin)
#### Post date: [August 18, 2016, 4:37am UTC](https://discuss.elastic.co/t/s3-input-not-working/58267/3 "2016-08-18T04:37:41Z")

</div>

Hi Mark,

No logs are making it into ES/Kibana. We have ES creating indices based on the type, like so:

output {  
amazon\_es {  
hosts =\> ["[redacted.es.amazonaws.com](http://redacted.es.amazonaws.com)"]  
region =\> "ap-southeast-2"  
manage\_template =\> false  
index =\> "%{[type]}-%{+YYYY.MM.dd}"  
}  
}

And there are no prod-elb indices being created.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 18, 2016, 4:49am UTC](https://discuss.elastic.co/t/s3-input-not-working/58267/4 "2016-08-18T04:49:16Z")

</div>

And if you add a `stdout {codec => rubydebug}` does it show anything?

---

<div class="post-metadata">

### Author: ![Zorlin](https://avatars.discourse-cdn.com/v4/letter/z/b782af/32.png) [@Zorlin](https://discuss.elastic.co/u/Zorlin)
#### Post date: [August 18, 2016, 5:22am UTC](https://discuss.elastic.co/t/s3-input-not-working/58267/5 "2016-08-18T05:22:54Z")

</div>

Hi - may test that later, but we have started on an alternative path already. We created a new S3 bucket and imitated the structure of the old one, and pulled in some logs to test - and now Logstash correctly processes those. In theory only three things have changed - a) name of bucket, b) number of folders and objects in those folders c) no Glacier objects.

We believe we've narrowed it down to two issues - either there was too many files in the old bucket, causing LS to choke, or the S3 input plugin doesn't like Glacier files. We're testing those theories now.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/s3-input-not-working/58267/6 "2017-07-06T04:42:55Z")

</div>



---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [August 8, 2018, 7:09pm UTC](https://discuss.elastic.co/t/s3-input-not-working/58267/7 "2018-08-08T19:09:39Z")

</div>

The S3 input will currently fail when attempting to process a glacier-archived file, but I've opened up a PR on the plugin to add support: [https://github.com/logstash-plugins/logstash-input-s3/pull/160](https://github.com/logstash-plugins/logstash-input-s3/pull/160)
