Document use of use_time_machine for S3 datasource

[arthurzenika]

What would you like to be added?

/kind enhancement

When using SQS based S3 log acquisition as described in https://docs.crowdsec.net/docs/data_sources/s3/ I get a warning in the logs :

level=warning msg="use_time_machine is not set to true in the datasource configuration. This will likely lead to false positives as S3 logs are not processed in real time." queue="https://sqs.eu-west-3.amazonaws.com/ACCOUNTID/example-queue-name" type=s3

The only place I can find mention of use_time_machine is in the IIS section https://docs.crowdsec.net/docs/getting_started/install_windows/#iis-logs

Why is this needed?

Complete documentation is nice.

[github-actions]

@arthurzenika: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@arthurzenika: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.

• /kind feature
• /kind enhancement
• /kind refactoring
• /kind bug
• /kind packaging

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[arthurzenika]

/kind enhancement

[LaurenceJJones]

Thank you for the issue, you are correct in pointing this out.

the key use_time_machine is a global acquisition configuration https://docs.crowdsec.net/docs/next/log_processor/data_sources/intro#use_time_machine rather than being directly connected to just s3 but the documentation should point out that to use this datasource you must use this key.

[LaurenceJJones]

Does the linked PR convey the information you would expect to be informed about when configuring the s3 datasource initially?

edit: we merged for now, but let me know if any of the information is not clear or needs a little more clarifying.

[arthurzenika]

What a quick fix ! Thanks!