hi
my need is that i have to send logs from date x to date y from a log file containing logs of many days.
i am using the log timestamp to compare with the time.now and then cancel the events matching a criteria,.
but the event.cancel is not working neither the timestamp comparision.Below config, i am comparing if the log is 5 days old
pls help
below is my config
input {
stdin {
codec => multiline {
pattern => "^\s"
what => "previous"
}
}
}
filter {
grok {
match => {"message" => "[%{YEAR:LogYear}-%{MONTHNUM:LogMonth}-%{MONTHDAY:LogDay} %{TIME:LogTime}] %{WORD:debuglevel} %{GREEDYDATA:logMessage}"}
}
mutate {
add_field => { "mytimestamp" => "%{LogYear}-%{LogMonth}-%{LogDay} %{LogTime}"}
}
date {
match => ["mytimestamp", "ISO8601"]
target => "@timestamp"
timezone => "Asia/Kolkata"
}
ruby {
init => "require 'time'"
code => "event.cancel if "(Time.now.to_f - @timestamp.to_f)" ) > (60 * 60 * 24 * 5)"
}
}
output{
stdout { codec => rubydebug }
}