How can I use %{} in input?


I want to use date variable in input, like below
input { elasticsearch{ hosts => ["localhost"] index => "test-%{+yyyy-MM-dd}" codec => "json" } }
but it occur error like this.
Error: [404] {"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index [test-%{+yyyy-MM-dd}]","resource.type":"index_or_alias","":"test-%{+yyyy-MM-dd}","index_uuid":"na","index":"test-%{+yyyy-MM-dd}"}],"type":"index_not_found_exception","reason":"no such index [test-%{+yyyy-MM-dd}]","resource.type":"index_or_alias","":"test-%{+yyyy-MM-dd}","index_uuid":"na","index":"test%{+yyyy-MM-dd}"},"status":404}

How can I use?

Thank you

A sprintf reference to a date, such as %{+yyyy-MM-dd} uses the value of @timestamp on an event to fill in the date. When the elasticsearch input is initializing there is no event, so there is no @timestamp field, so this does not work.

You might be able to use an environment variable. See here for an example.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.