Hourly log rotation?

[Sjaak01 (Sjaak)]

Hi,

Is it possible to create hourly log files?

output {
 if [type] == "netflow" {
 file {
   path => "/home/test/Desktop/test/netflow-%{+YYYY-MM-dd-HH}.gz"
   gzip => true
 }
}
}

Creates a properly timestamped file when I start logstash but doesn't create a new file every hour.

[theuntergeek (Aaron Mildenstein)]

Logstash won't create a file if there isn't new data, or if the @timestamp field has older data. It doesn't just say, "oh, the hour has rolled over, I should create a new file." It writes events out, as they are received by the file output plugin, to a file whose name is partially derived from the date value in the @timestamp field in this case.

I can't see if you're using the date filter to parse timestamps, but that can affect things, as the %{+YYYY-MM-dd-HH} string reads those values from @timestamp.