Skip to main content
Solved

Cribl Stream: S3 Collector path syntax error, use quotes for variables

  • Nov 4, 2026 11:54 AM UTC
  • 20 replies
  • 0 views
This message originated from Cribl Community Slack.
Click here to view the original link.

Hello, I am using S3 collector in stream and for some reason when i use what seams like a supported input for the s3 bucket path i get an error indicating that a bracket is missing. 'Bucket/path/'+${_time:%Y}-${_time:%m}-${_time:%d}+'/'. The error returns saying i need a bracket in the front, {. I tried other variations like 'Bucket/path/'+${_time:%Y-%m-%d+'/' but i get the same error but with the closed bracket instead, }. Any tips on what could be wrong or could this be a bug?

Best answer by dbizon539

Yeah it should be in quotes. Just a simpler / more compact way to have it set to what you were using before. As for why its collecting today - what were your earliest/latest you were using when running the collector? If latest is set to now then it will collect today
View original

20 replies

  • dbizon539
  • Employee
  • Nov 4, 2026 11:54 AM UTC
Can you try this one? 
'Bucket/path/${_time:%Y}-${_time:%m}-${_time:%d}/'
Or this one? 
'Bucket/path/' + '${_time:%Y}-${_time:%m}-${_time:%d}/'
Yes, back ticks result in the same errors.
  • dbizon539
  • Employee
  • Nov 4, 2026 11:54 AM UTC
It looks like you are closing out the strings for the variables but they should also be within the backticks For example this one: 
'Bucket/path/'+${_time:%Y}-${_time:%m}-${_time:%d}+'/'
You closed out the backtick right before the variable
cut and pasted the example. same errors though.

Links for this message:
Screenshot 2026-10-14 at 1.36.37 PM.png
  • dbizon539
  • Employee
  • Nov 4, 2026 11:54 AM UTC
Yeah so remove the backtick off after path/ and after the last + so its all in one string
wouldnt that just make this expression a string?

Links for this message:
Screenshot 2026-10-14 at 1.38.47 PM.png
  • dbizon539
  • Employee
  • Nov 4, 2026 11:54 AM UTC
Yes and no. You do not need the +'s anymore since you are not concat the string but with it outside of the string it is trying to parse it as an expression. So it should ultimately look like this: 
'Bucket/path/${_time:%Y}-${_time:%m}-${_time:%d}/'
here is how it appears when using backticks.

Links for this message:
Screenshot 2026-10-14 at 1.41.30 PM.png


Links for this message:
Screenshot 2026-10-14 at 1.42.36 PM.png
  • dbizon539
  • Employee
  • Nov 4, 2026 11:54 AM UTC
Yeah keep it as single quotes, no need for backticks
so leaving it as a string? will it know im inputing collection for the a specific time?
  • dbizon539
  • Employee
  • Nov 4, 2026 11:54 AM UTC
Yes it should return the time as you have it in the bucket (so _time:%Y will return the year)
I just tried it to test if it will collect from 4 days ago and it fails. Only works when i put in a hard date into the path.
  • dbizon539
  • Employee
  • Nov 4, 2026 11:55 AM UTC
Looking to see why it would be failing
sorry i should have been more clear. it collects, but for the wrong day. it collects logs from today instead of the 10th.
  • dbizon539
  • Employee
  • Nov 4, 2026 11:55 AM UTC
This might be a better solution (taken from our page) /my/path/${_time:%Y-%m-%d}/ - Link is here
without the quotes it just mistakes it for a regex pattern.

Links for this message:
Screenshot 2026-10-14 at 1.55.32 PM.png
  • dbizon539
  • Employee
  • Answer
  • Nov 4, 2026 11:55 AM UTC
Yeah it should be in quotes. Just a simpler / more compact way to have it set to what you were using before. As for why its collecting today - what were your earliest/latest you were using when running the collector? If latest is set to now then it will collect today
Ah that is what it was. Thank you Daniel! instead of using -4d in the latest, i tried to use absolute and it collected for the 10th. so this should work now. thank you!
  • dbizon539
  • Employee
  • Nov 4, 2026 11:55 AM UTC
You're welcome! Glad it is working for you now!
Terms & ConditionsAccessibility statement