I'm not sure about the usage of S3 output plugin for Logstash.
For instance, I'm using it and everything seems to work well but I don't want to use aws:kms encryption instead I want to specify my key.
According to the documentation, you need to use server_side_encryption => true and server_side_encryption_algorithm can be AES256 or aws:kms.
In my case I want AES256, because I don't want Amazon have control over my keys, but how do I specify my key?
Even if I use ssekms_key_id => "my_key" I'm still be able to get the file from AWS no crypted. When I download it, all the fields are readable.
That must not happen.
I believe you're misunderstanding how the S3 plugin works here.
server_side_encryption => true
server_side_encryption-algorithm => AWS256
This combination tells the plugin to use the default server side encryption option that comes with S3. Per the Amazon documentation, encryption and decryption happens automatically. If you have the rights to view that file, you can decrypt it.
server_side_encryption => true
server_side_encryption-algorithm => aws:kms
ssekms_key_id => 'string'
This combination functions the same way as the AES256 variant, but instead uses a key from your Amazon KMS archive. As with the previous config, encryption/decryption happens automatically on PUT and GET. It is stored encrypted on the Amazon servers, but is never delivered encrypted.
The Amazon APIs do not support, that I know of, uploading a private key to crypt your data against with every PUT call. To use your own key, you need to import it into KMS, and use the KMS KEY ID of the uploaded key in your plugin config. It will still GET in clear-text, though. KMS is there to manage keys, and is documented to be zero-knowledge by Amazon.
If you want to get the crypt-text back, the data you upload to the bucket needs to be encrypted before it is uploaded. This plugin will not do that for you.