Conditional for @timestamp

Elastic Stack Logstash
1

Is it possible to create a conditional for the @timestamp field, so for example if I get a message with a timestamp older than 1h then do something?

2

It's possible, but Logstash's configuration language doesn't support date math so you'll have to do that in a ruby filter. The filter could set a tag that a standard conditional acts upon.

3

Thats exactly what I did, the power of Ruby and the simplicity of Epoch timestamps is a wonderful thing

ruby {
  code => "event['EventTimeDrift'] = (Time.now.to_f * 1000).to_i - event['EventTime'].to_i"
}
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.