How can I create 12h based index in logstash

I want to create a 12h based logstash index.
can you please let me know any way how can I achieve it?

I haven't seen anyone do this, not sure it's possible with the date math it can do.

Why are you asking for it?

Using a date pattern like YYYY.MM.dd.aa in your elasticsearch output configuration's index option should work (you'll get "am" or "pm" to indicate which half of the day an event originated from).

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.