Logstash Output File Rotate

sdeshpande · February 28, 2017, 1:36pm

Hi Guys,

Can someone please tell me if it is possible to rotate the Output File generated by Logstash output plugin ?
In Logstash config I have following lines and was wondering if I can specify option to configure rotation.
output {
file {
path => "/datacollection/lostash/output/packetbeat-%{+YYYY-MM-DD}.txt"
gzip => true
}
}

Regards

magnusbaeck · February 28, 2017, 2:00pm

What rotation options are you interested in?

sdeshpande · February 28, 2017, 2:05pm

Looking for either per hour rotation or Size based rotation.

Regards

magnusbaeck · February 28, 2017, 2:08pm

Looking for either per hour rotation or

So change %{+YYYY-MM-DD} to e.g. %{+YYYY-MM-DD-HH} or whatever you like. But I'm pretty sure you should use YYYY-MM-dd instead of YYYY-MM-DD.

Note that the timestamp that's expanded in the expression above is @timestamp, which normally should be the event time rather than the current time.

Size based rotation.

That's not supported (within Logstash itself anyway).

sdeshpande · February 28, 2017, 2:11pm

Thank you. I will give this a try.

Regards

sdeshpande · February 28, 2017, 2:51pm

Is there a way to convert the Hour in EST as opposed to UTC ?

magnusbaeck · February 28, 2017, 2:57pm

Nope.

sdeshpande · February 28, 2017, 3:00pm

So when presenting this data to analytics engine we will have to make the adjustment based on our timezone, is that correct ?

magnusbaeck · February 28, 2017, 3:08pm

I don't know anything about your analytics engine and what it expects, but the @timestamp field and everything based on it is UTC.

sdeshpande · February 28, 2017, 3:11pm

Thank you for the quick response.

system · March 28, 2017, 3:12pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.