I want to create a 12h based logstash index.
can you please let me know any way how can I achieve it?
I haven't seen anyone do this, not sure it's possible with the date math it can do.
Why are you asking for it?
Using a date pattern like YYYY.MM.dd.aa in your elasticsearch output configuration's index option should work (you'll get "am" or "pm" to indicate which half of the day an event originated from).
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.