The elasticsearch output takes a setting for the index name, with a default of 'logstash-YYYY.MM.dd'. Where does the 'YYYY.MM.dd' come from? Are there other options, such as time (e.g. HHmmss), week of year, day of year, locale month name, etc?
Ok, but that isn't quite what I was asking for. Let's say I wanted to create an index that is named by the year, week of year, and day of week (ok, stupid example). If I assume that the default 'YYYY.MM.dd' specification comes from the same Joda DateTimeFormat as the logstash date filter plugin, my ugly index name in the elasticsearch output would be:
index => "logstash-%{+YYYY.ww.ee}"
So, is the format specification the Joda DateTimeFormat, or something completely different?
Are there other options? With the %{} format, can I access other logstash terms, like the type, or, I don't know, the host name, etc.?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.