How to pass date from messages to output filename in logstash

I have a requirement to name the output file based on the date present in input messages.

I want to assign the incoming date to metadata and then use it in the output like

path => /path/location/filename_%{[@metadata][log_date]}.log

I am on logstast2.2 and giving %{+yyyy-MM-dd} directly in path is not working. Please help

I've tried in the following 2 ways:

Where my events have the timestamp in the @timestamp field:

file {
      path => "/tmp/log-%{@timestamp}"

Result files (each event in its own file):


Or using the way you described:

file {
      path => "/tmp/log-%{+YYYY-MM-dd}"

Result files:

log-2017-08-31 (all events of this day inside this file)
log-2017-09-01 (all events of this day inside this file)

I think the version 2.2 supports both methods.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.