Find source code of index date in elasticsearch output plugin

Elastic Stack Logstash
1

Hi,

After some research I found the confirmation that when using the elasticsearch output plugin and using the date for the index name, it automatically uses the '@timestamp' field. I was also interested in finding in the source code (https://github.com/logstash-plugins/logstash-output-elasticsearch) where that happens.

I have very little experience with ruby and can't seem to find that specific part of the code, therefore I'd like ask for some help in finding it.

2

Take a look at this and this.

3

So in fact its not logstash who puts the date in the index, but ElasticSearch itself. Logstash only gives the format (or in other cases, the field) it wants to use for that event and then ES does the rest.

Thank you very much.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.