How is -%{+YYYY.MM.dd} generated on Logstash output

Elastic Stack Logstash
1

Hello,

I use daily ES indices that are created by Logstash using

output {

  elasticsearch {
...
        index => "%{[@metadata][foo]}-%{+YYYY.MM.dd}"
  }
}

I always assumed that Logstash looks up the date from the system but now I am seeing some evidence that it might come from @timestamp in the log message. Could someone confirm this suspicion?

Cheers,
AB

2

Confirmed. It is based on @timestamp.

2 Likes
3

Thank you @Badger

4

The behavior is documented here: https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.