Logstash Output File - Add data in filename

Elastic Stack Logstash
1

Hi,

i would like to add the current date into the name of the file created by logstash process.
The date isn't an information that i received in input, but i have to get it.

I had succeeded, adding the following code to the filter section:

ruby {code => "event.set('time_log',Time.now().strftime('%Y-%m-%d'));"}

in output section:

file {
path => "/dati/LOG_JSON/ascc_disp-%{time_log}.log"
}

the file name is written correctly

ascc_disp-2019-12-04.log

but the value contained in the time_log variable is also present in the json sent on queue kafka.

below is the complete output section:

output {
kafka {
codec => json
topic_id => "in.dispositivi"
acks => "0"
bootstrap_servers => "xxx.xxx.xxx.xxx:9092"
security_protocol => "SSL"
client_id => "test"
ssl_truststore_location => "/dati/logstash/logstash-7.1.1/config/keystore.jks"
....
....
}

file {
path => "/dati/LOG_JSON/ascc_disp-%{time_log}.log"
}
}

How can I use the variable only to construct the file name, and exclude it from the contents of the json I send to kafka?

thank you very much,

Giorgio

2

If a field is nested inside [@metadata] then it is not sent with the rest of the event to the output, so replace [log_time] with [@metadata][log_time].

3

thank you so much @Badger for the suggestion.
I tried it and it works.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.