How can I create 12h based index in logstash


(sanket) #1

I want to create a 12h based logstash index.
can you please let me know any way how can I achieve it?


(Mark Walkom) #2

I haven't seen anyone do this, not sure it's possible with the date math it can do.

Why are you asking for it?


(Magnus B├Ąck) #3

Using a date pattern like YYYY.MM.dd.aa in your elasticsearch output configuration's index option should work (you'll get "am" or "pm" to indicate which half of the day an event originated from).


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.