Date in logstash input

Elastic Stack Logstash
1

Hi, apologies if this has been asked before.

I have logstash pulling the full contents of an index from elastic on a daily basis. In elastic a new index is created every day that contains that days data, it's called index-YYYY-MM-DD.

Basically my question is how do I get logstash to enter todays date into the index name? My input code is:

input {
elasticsearch {
hosts => "localhost:9200"
index => "index-%{+YYYY-MM-DD}"
query => '{"query" : {"match_all" : {} } }'
}
}

Thanks in advance

2

Is Logstash running in the background all the time or are you starting it every day to perform this action?

3

At the moment I'm just testing so running it manually, I hope to have it running as a service with a CRON job to pull the data daily once I've got it working

4

Well, either way it's not running continuously so you can set an environment variable to today's date and reference that variable in your configuration via the ${VARIABLE_NAME} notation.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.