How to drop delayed events beyond a certain threshold?

Elastic Stack Logstash
1

Hi,

I need correct syntax for below pseudo code

filter {
if [timestamp] < now - 120 {
drop {}
}
}

i want to drop messages delayed for more than 120secs in certain usage.
I did search for 2 hrs before posting this message.
What docs should i have seen to avoid this post ?

Thnaks & Regards for this wonderful software.

Rajesh Mallah.

2

You could for example use a ruby filter. Its documentation contains an example that's fairly close to what you want to do.