Elasticsearch filter - Search previous days index

Elastic Stack Logstash
1

Currently I use the elasticsearch filter to search for specific events that have occurred.

The index I am searching is index => "filebeat-*-%{+y}.%{+MM}.%{+dd}"

I'm looking to query both today's index and also yesterday's as events may overlap by a day.

Looking at the documentation here, it allows a comma-delimited list of index names to search however I am unable to work out the correct syntax to check for yesterday's date.

Originally I thought about using a similar method that appears to work in Watcher alerts as below to search both today and yesterday's indices however this doesn't appear to work in the elasticsearch filter.

index => "filebeat-*-{now-1d}, filebeat-*-{now}"

Any ideas on how to achieve this?

Cheers

2

Got this working with the following:

index => "<filebeat-*-{now}>,<filebeat-*-{now-1d}>"

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.