Compare Dates in Logstash Pipeline

Elastic Stack Logstash
2

Welcome @d-ring

I know you can compare two dates that are in the same format (eg ISO8601 ) like this:

if [date1] <= [date2] {
}

But as you say, that would require you to create another date field for 30 days ago.. In this post => Adding 1 day to the date

something similar is done with a ruby filter, please check that out and see if you can make it work. :slight_smile:

Grtz

Willem