Index name removes date


I am using Logstash 7.2.0 and have encountered an issue with naming my index with a timestamp. An index is created in Logstash, but it doesn't contain the date. It only contains the characters before the dash. For example, if the index is named performance-%{YYYY.MM.dd} the index created in Elasticsearch is only performance- and the date is missing.

My output config is:
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["10.x.x.x:9200"]
user => "user"
password => "password"
action => "update"
doc_as_upsert => true
document_id => "%{uuid}"
index => "test-%{+YYYY.MM.dd}"

I also tried lowercase yyyy thinking maybe the syntx is incorrect. but it did not work either.



My reading of the code is that that means you have deleted the @timestamp field.

Thank you! Not sure why I did that, but that was definitely the problem.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.