Logstash filter code that sends a query to related indices by wild card [indexname-*]

Hello All,

Can someone please help me out how can I write custom filter in logstash to achieve the following:

Making a custom logstash filter that sends a query to related indices by wild card (indexname-*) for records with that(Unique id present in all rollover index) _id and if there are existing ones and not belongs to current day's index, it will remove them and insert the current event to current rollover index instead.

I want to do update/delete operation on my indices data.

I would also like to understand will it slowdown logstash events processing to logstash if above is applied?, Surely it will slow down I suppose.

Many Thanx

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.