Create monthly indexes based on event attribute


(Karasmeitar) #1

Hi All,
can i perform JODA functions in the output section on other attributes then timestamp(%{+YYYY.MM})?
i need to create indexes base on couple of attributes in my event and i can't use only the timestamp.


Indexing documents to elasticsearch monthly?
(Mark Walkom) #2

What do you want to use?


(Karasmeitar) #3

i have 2 dates attributes in the event:
date {
match => ["install_date", "UNIX_MS"]
target=> "install_date_index_time"
}
date{
match => ["calendar_date","UNIX_MS"]
target => "calendar_date_index_time"

I want to insert the event to index name calendar_date_index_time{YYYY.MM} and install_date_index_time.YYYY.MM


(system) #4