Logstash Output File Rotate

Elastic Stack Logstash
1

Hi Guys,

Can someone please tell me if it is possible to rotate the Output File generated by Logstash output plugin ?
In Logstash config I have following lines and was wondering if I can specify option to configure rotation.
output {
file {
path => "/datacollection/lostash/output/packetbeat-%{+YYYY-MM-DD}.txt"
gzip => true
}
}

Regards

1 Like
2

What rotation options are you interested in?

3

Looking for either per hour rotation or Size based rotation.

Regards

4

Looking for either per hour rotation or

So change %{+YYYY-MM-DD} to e.g. %{+YYYY-MM-DD-HH} or whatever you like. But I'm pretty sure you should use YYYY-MM-dd instead of YYYY-MM-DD.

Note that the timestamp that's expanded in the expression above is @timestamp, which normally should be the event time rather than the current time.

Size based rotation.

That's not supported (within Logstash itself anyway).

5

Thank you. I will give this a try.

Regards

6

Is there a way to convert the Hour in EST as opposed to UTC ?

7

Nope.

8

So when presenting this data to analytics engine we will have to make the adjustment based on our timezone, is that correct ?

9

I don't know anything about your analytics engine and what it expects, but the @timestamp field and everything based on it is UTC.

10

Thank you for the quick response.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.