Logstash configuration to defaul current date

Elastic Stack Logstash
1

Hi All,

My application logs have only timestamp information but not date ( hh:mm:ss.SSS). By default logstash is considering the date as 2016-01-01 instead of current date.

          "@timestamp" => "2016-01-01T01:40:57.122Z",
           "timestamp" => "10:40:57.122",

what is the configuration/plug-in to make the date defaulted to current date? if I want backfill old logs - how to configure this other than hardcoding ?( sorry it might be basic question for but I did not figure out yet);

2

There's no way to change this default, but you can use a ruby filter to obtain the current date and prepend that in front of your timestamp, then feed the resulting string to the date filter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.