Logstash output exec executed only once

Elastic Stack Logstash
1

Hi,

is there a possibility to run an output exec command only once per logfile and not with every processed document?
My data comes from CSV-files and I want to delete them after they have been processed by Logstash. I could do this with Logstash's exec output plugin executing an "rm %{path}" as command, but this is done for every row that is in the file and the total number of entries sometimes is >> 10.000.
Maybe there is an internal counter or something like that, which I could check in an if statement, so that it is only executed with the first document?

Thanks in advance 4 your help.

2

It could be done, but that doesn't make it a good idea :slight_smile:

    ruby {
        code => '
            if @first.nil?
                event.set("[@metadata][first]", true)
            end
            @first = false
        '
    }
    if [@metadata][first] { [...]
3

Thank you very much. That's already way faster.
Is there another way solving this task?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.