Date in logstash input

(Kyle) #1

Hi, apologies if this has been asked before.

I have logstash pulling the full contents of an index from elastic on a daily basis. In elastic a new index is created every day that contains that days data, it's called index-YYYY-MM-DD.

Basically my question is how do I get logstash to enter todays date into the index name? My input code is:

input {
elasticsearch {
hosts => "localhost:9200"
index => "index-%{+YYYY-MM-DD}"
query => '{"query" : {"match_all" : {} } }'

Thanks in advance

(Magnus Bäck) #2

Is Logstash running in the background all the time or are you starting it every day to perform this action?

(Kyle) #3

At the moment I'm just testing so running it manually, I hope to have it running as a service with a CRON job to pull the data daily once I've got it working

(Magnus Bäck) #4

Well, either way it's not running continuously so you can set an environment variable to today's date and reference that variable in your configuration via the ${VARIABLE_NAME} notation.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.