Limit input data to recent data only, like Last 24 hours

Elastic Stack Logstash
1

Hello,

I'm using Elasticsearch input plugin with Csv output plugin as part of my pipeline and even though everything works as expected, my pipeline would write all data from elasticsearch into csv file, yet I would like to limit input data to recent data only, like Last 24 hours...

How does one accomplish something like that?

Please advise.

2

You should be able to use the Elasticsearch input plugin's query setting to limit your elasticsearch results to the resulting documents.

3

@jordansissel

Could you provide an example? I did noticed query as part of input plugin, however I can't figure out how to specified last 24 hours or whatnot with query...

Thanks in advance.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.