Filter data based on dates and days

[stella_raj]

Hi,

Need to filter data based on specific dates and days.
Suggest any filter plugin that will fulfil my requirement.

Thanks

[sai_saran1 (Sai Saran V)]

You can use ruby filter with the specific condition something like the below if you are getting the day in the logline

ruby {
code => "event.cancel if "Day" = "Sunday""
}

[Badger]

If you want to drop events then you can either use a drop {} filter (if you can identify the events using a logstash conditional) or use event.cancel within a ruby filter to implement much more complicated filtering of events.

How to choose between them will require a more detailed problem specification. For example, do you want to drop everything from a certain list of dates, or everything on a Saturday? Is this based on [@timestamp] or some other field?

Please show a field you want to filter on, either from the output of output { stdout { codec => rubydebug } }, or else JSON from Kibana, as well a specific example of filtering that you want to implement.