Hello All,
Can someone please help me out how can I write custom filter in logstash to achieve the following:
Making a custom logstash filter that sends a query to related indices by wild card (indexname-*) for records with that(Unique id present in all rollover index) _id and if there are existing ones and not belongs to current day's index, it will remove them and insert the current event to current rollover index instead.
I want to do update/delete operation on my indices data.
I would also like to understand will it slowdown logstash events processing to logstash if above is applied?, Surely it will slow down I suppose.
Many Thanx