Hi all,
Is there anyway to retrieve and output file's last modification date with filebeat ?
Thank you.
Really no idea ?
This is currently not possible with filebeat. Perhaps you can share your use case?
Thanks for answering, I was feeling lonely !
Our use case : we are indexing whole files. Each file is an event so only one document. And we do not have no date in the file content. We don't want to use the indexing timestamp because we are indexing "old" files and the indexing timestamp will not match the file's last modification date.
By the way, as you said it is not currently possible so we have to find another solution...
You could check if LS has a plugin for doing something like that.
The problem is that LS does not have access to the files.
I'll have a look to LS plugins but I think only Filebeat can provide this information.
I meant using LS to also ingest the files. It would be possible to add the date on the filebeat side rather easy. Perhaps you can open a feature request for it? I'm a bit worried that it will add more data which most of the users will not needed. Definitively worth discussing.
But LS is on a dedicated server and cannot access files. And we don't want to have specialized architectures depending on source files (dedicated LS for example).
I will try to open a feature request as you suggest.
We also have a fallback solution: there is a datetime in the file name. But we have many source files and each file has it own file name template with different date format... But we could achieve it.
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.