Hi All,
can i perform JODA functions in the output section on other attributes then timestamp(%{+YYYY.MM})?
i need to create indexes base on couple of attributes in my event and i can't use only the timestamp.
What do you want to use?
i have 2 dates attributes in the event:
date {
match => ["install_date", "UNIX_MS"]
target=> "install_date_index_time"
}
date{
match => ["calendar_date","UNIX_MS"]
target => "calendar_date_index_time"
I want to insert the event to index name calendar_date_index_time{YYYY.MM} and install_date_index_time.YYYY.MM