Logstash generate timely csv output

(Manoj Hettiarachchi) #1


In my system, I use the csv output plugin. The output block is as follows.

output {
csv {
               path => "/var/csv_reports/%{+YYYY}-%{+MM}-%{+dd}/transaction-report.csv"
               fields => ["timestamp","tid","api","response_time"]

With this configuration, I am able to generate a separate CSV report for each day.
But the generated file size is too large because of this I need to generate separate files for 8-hour intervals.

I know that by adding %{+HH} we can generate hourly reports. But then there will be 24 reports of each day. So that is not my requirement.

Please advise how to achieve this requirement.