# Send logs to AWS S3

**URL:** https://discuss.elastic.co/t/send-logs-to-aws-s3/42914
**Category:** Elasticsearch
**Created:** [February 27, 2016, 7:53am UTC](https://discuss.elastic.co/t/send-logs-to-aws-s3/42914 "2016-02-27T07:53:22Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)
#### Post date: [February 27, 2016, 7:53am UTC](https://discuss.elastic.co/t/send-logs-to-aws-s3/42914/1 "2016-02-27T07:53:22Z")

</div>

I have setup ELK on AWS EC2. and started sending logs to it. But after 1 week logserver stopped working due to less space on device.

So I need to move the logs to S3 . But no idea of that.

Please help me to start with it.

Thanks

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 28, 2016, 3:13am UTC](https://discuss.elastic.co/t/send-logs-to-aws-s3/42914/2 "2016-02-28T03:13:06Z")

</div>

You can use S3 to [store snapshots](https://www.elastic.co/guide/en/elasticsearch/reference/2.2/modules-snapshots.html) of old logs. You could also use Logstash to [extract data from ES](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html) and then [send to S3](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-s3.html).

You will still need to delete data from ES once you have done the extract though. The data in S3 will also not be available to query, you will need to reimport it to ES.

---

<div class="post-metadata">

### Author: ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)
#### Post date: [March 4, 2016, 12:12pm UTC](https://discuss.elastic.co/t/send-logs-to-aws-s3/42914/3 "2016-03-04T12:12:10Z")

</div>

I see your links to create snapshots and extract data from ES. But I dont understand much from these links.  
Is it possible to store logs in S3 without creating snapshots, also view logs in kibana directly from S3?

Can you explain in a simple way?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 4, 2016, 9:07pm UTC](https://discuss.elastic.co/t/send-logs-to-aws-s3/42914/4 "2016-03-04T21:07:38Z")

</div>

> [@babeesh](#):
>
> Is it possible to store logs in S3 without creating snapshots, also view logs in kibana directly from S3?

No you cannot.

---

<div class="post-metadata">

### Author: ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)
#### Post date: [March 8, 2016, 5:22am UTC](https://discuss.elastic.co/t/send-logs-to-aws-s3/42914/5 "2016-03-08T05:22:33Z")

</div>

In what condition this restore should be performed?

If I need to view some old logs, Should I need to restore from S3 snapshot?

or

If logserver failed ?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 11, 2016, 11:12pm UTC](https://discuss.elastic.co/t/send-logs-to-aws-s3/42914/6 "2016-03-11T23:12:30Z")

</div>

Either are valid restore requirements.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:09pm UTC](https://discuss.elastic.co/t/send-logs-to-aws-s3/42914/7 "2017-07-05T23:09:01Z")

</div>


