IndexName with current date

Elastic Stack Logstash
1

Hi All,

Please suggest how to create index name with current date.
PFB snippet from my logstash config file-

output {
elasticsearch {
action => "index"
index => "[datewise-]YYYY.MM.DD"
}

I am getting error for name structure with above logstash config.

Regards,
Prateek

2

you can see an example how to use this from the same logstash output, see https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/common_configs.rb#L11

logstash-%{+YYYY.MM.dd}

more details as could be seen in the documentation

``` # The index to write events to. This can be dynamic using the %{foo} syntax.
# The default value will partition your indices by day so you can more easily
# delete old data or only search specific date ranges.
# Indexes may not contain uppercase characters.
# For weekly indexes ISO 8601 format is recommended, eg. logstash-%{+xxxx.ww}.
# LS uses Joda to format the index pattern from event timestamp.
# Joda formats are defined http://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html[here].

2 Likes
3

Thank you. It worked great for me.

Regards,
Prateek