I am outputting to Elasticsearch with date specific indices. My server time zone is in IST but problem I am facing is my Elasticsearch index changes as per UTC time zone.
How can i change timezone or ES index creation time as per IST
Please find my output which I have writter.
output {
if [componentId] in [0,10] {
file {
path => "/home/manthanb/logstash_output.txt"
}
}else{
elasticsearch {
hosts => ["10.10.3.44:9200"]
index => "logstash-%{componentId}-%{+YYYY.MM.dd}"
}
}
}
You'd have to get the date in local time into another field that you can reference in the index option's value. None of the stock filters do this so you'l have to resort to a ruby filter.
People are frequently asking about this and I don't understand why the exact time of index rollover matters.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.