Heads up..
If you're using the s3 input and you don't see any action in your logs it may likely be the case that the (current) version requires a trailing slash if you're wanting to parse a directory.
Ommitting a trailing slash will result in a silent failure.
s3 {
access_key_id => ".."
secret_access_key => ".."
bucket => "sometimes-its-hard"
region => "us-west-2"
prefix => "logs/" <-----
type => "s3"
interval => 10
}
Can we get this documented (https://www.elastic.co/guide/en/logstash/current/plugins-inputs-s3.html#plugins-inputs-s3-prefix) or fixed?
I am a devoted es advocate but these little things cause a lot of pain downstream for those practicing discipline and maturity in the devops wheelhouse.
--
logstash 5.2.2