# Logstash generate timely csv output

**URL:** <https://discuss.elastic.co/t/logstash-generate-timely-csv-output/158471>\
**Category:** Logstash\
**Created:** [November 28, 2018, 6:16am UTC](https://discuss.elastic.co/t/logstash-generate-timely-csv-output/158471 "2018-11-28T06:16:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manoj\_Hettiarachchi](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Manoj\_Hettiarachchi](https://discuss.elastic.co/u/Manoj_Hettiarachchi)\
**Post date:** [November 28, 2018, 6:16am UTC](https://discuss.elastic.co/t/logstash-generate-timely-csv-output/158471/1 "2018-11-28T06:16:20Z")

</div>

Hello,

In my system, I use the csv output plugin. The output block is as follows.

```
output {
csv {
               path => "/var/csv_reports/%{+YYYY}-%{+MM}-%{+dd}/transaction-report.csv"
               fields => ["timestamp","tid","api","response_time"]
       }
}

```

With this configuration, I am able to generate a separate CSV report for each day.  
But the generated file size is too large because of this I need to generate separate files for 8-hour intervals.

I know that by adding %{+HH} we can generate hourly reports. But then there will be 24 reports of each day. So that is not my requirement.

Please advise how to achieve this requirement.

Thanks,

---

<div class="post-metadata">

**Author:** ![Manoj\_Hettiarachchi](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Manoj\_Hettiarachchi](https://discuss.elastic.co/u/Manoj_Hettiarachchi)\
**Post date:** [December 19, 2018, 5:48am UTC](https://discuss.elastic.co/t/logstash-generate-timely-csv-output/158471/2 "2018-12-19T05:48:45Z")

</div>

I have used a ruby base approach for this requirement. I have used a ruby code to generate custom file names checking the timestamp value in the log lines. My code is as follows to generate files for each 8 hour interval.

```
ruby {
        code => "
        require 'date'
        interval = 8
        date2 = DateTime.strptime(event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d_%H-%M-%S'), '%Y-%m-%d_%H-%M-%S')
        date = DateTime.now
        val = date2.hour/interval +1
        event.set('append_val', val) 
        event.set('index_day', event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d'))"
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2019, 5:48am UTC](https://discuss.elastic.co/t/logstash-generate-timely-csv-output/158471/3 "2019-01-16T05:48:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.