Amazon S3 Streams
A stream under an Amazon S3 source watches one bucket and, optionally, a key prefix. There's no file path - you point at where the log objects land, and LogRaker polls for new ones.
Bucket
The S3 bucket to watch, e.g. my-logs-bucket. Required.
Prefix (optional)
A key prefix that scopes the listing to just the objects you care about, e.g. AWSLogs/123456789012/elasticloadbalancing/us-east-1/. Leave it blank to watch the whole bucket. For a bucket with a lot of objects, a prefix is strongly recommended - it keeps each poll cheap and focused. (A listing is bounded: if it would run past ten pages, LogRaker stops and shows a note asking you to narrow the prefix, rather than paging forever.)
Poll every (optional)
How often LogRaker lists the bucket for new objects, in seconds. Leave it blank for the default (30 seconds). Listing is inexpensive, so there's little reason to change it - but a very chatty prefix can poll faster, and a quiet one slower.
Format
Delivered objects are read as generic log text - one record per line, with gzip decompressed automatically when detected. This handles ALB / ELB and CloudFront access logs, CloudTrail JSON, Firehose output, and plain-text or NDJSON logs. First-class parsers that break specific formats into named fields are planned for a later release; today every S3 log is shown as its raw lines.
Filter (display)
The pill filter is the same client-side display filter every stream kind has: it hides non-matching lines in the pane without changing what's fetched. Strip matched text from output redacts the matched substring from the lines it keeps.
Auto-stream at startup
When on, the stream starts watching automatically when LogRaker launches. When off, it comes online the first time you select it in the sidebar.
Seeding on connect
When a stream first connects, LogRaker seeds the pane with the most recent objects under the prefix so it isn't empty, then polls forward from there - showing each new object as it's delivered. It remembers where it left off, so a brief network blip resumes forward without re-showing lines or skipping any. Because delivery to S3 is batched, new objects appear a few minutes behind live (typically 1-5), set by the log producer.
Test
Click Test to list a recent object under the bucket and prefix with the source's credentials. It confirms the bucket is reachable and that this identity can read it, and tells you whether any objects are present yet.