How can I use %{+yyyy.mm.dd} in input?

Elastic Stack Logstash
1

Hello.

I want to use date variable in input, like below
input { elasticsearch{ hosts => ["localhost"] index => "test-%{+yyyy-MM-dd}" codec => "json" } }
but it occur error like this.
Error: [404] {"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index [test-%{+yyyy-MM-dd}]","resource.type":"index_or_alias","resource.id":"test-%{+yyyy-MM-dd}","index_uuid":"na","index":"test-%{+yyyy-MM-dd}"}],"type":"index_not_found_exception","reason":"no such index [test-%{+yyyy-MM-dd}]","resource.type":"index_or_alias","resource.id":"test-%{+yyyy-MM-dd}","index_uuid":"na","index":"test%{+yyyy-MM-dd}"},"status":404}

How can I use?

Thank you

2

A sprintf reference to a date, such as %{+yyyy-MM-dd} uses the value of @timestamp on an event to fill in the date. When the elasticsearch input is initializing there is no event, so there is no @timestamp field, so this does not work.

You might be able to use an environment variable. See here for an example.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.