Conditional for @timestamp

Is it possible to create a conditional for the @timestamp field, so for example if I get a message with a timestamp older than 1h then do something?

It's possible, but Logstash's configuration language doesn't support date math so you'll have to do that in a ruby filter. The filter could set a tag that a standard conditional acts upon.

Thats exactly what I did, the power of Ruby and the simplicity of Epoch timestamps is a wonderful thing

ruby {
  code => "event['EventTimeDrift'] = ( * 1000).to_i - event['EventTime'].to_i"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.