Drop old messages


#1

Hi all,
i'm reading with logstash several files and after send to ES.
I this files i have also old log lines with timestamps. How can avoid to send to ES the rows with old timestamp?

I can use drop filter, but what is the condition to check?

BR


Drop old messages using Ruby filter
(Magnus B├Ąck) #2

Check out the age filter (https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-age.html).


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.