Logstash Output File Rotate

Elastic Stack Logstash
1

Hi Guys,

Can someone please tell me if it is possible to rotate the Output File generated by Logstash output plugin ?
In Logstash config I have following lines and was wondering if I can specify option to configure rotation.
output {
file {
path => "/datacollection/lostash/output/packetbeat-%{+YYYY-MM-DD}.txt"
gzip => true
}
}

Regards

2

What rotation options are you interested in?

3

Looking for either per hour rotation or Size based rotation.

Regards

4

Looking for either per hour rotation or

So change %{+YYYY-MM-DD} to e.g. %{+YYYY-MM-DD-HH} or whatever you like. But I'm pretty sure you should use YYYY-MM-dd instead of YYYY-MM-DD.

Note that the timestamp that's expanded in the expression above is @timestamp, which normally should be the event time rather than the current time.

Size based rotation.

That's not supported (within Logstash itself anyway).

5

Thank you. I will give this a try.

Regards

6

Is there a way to convert the Hour in EST as opposed to UTC ?

7

Nope.

8

So when presenting this data to analytics engine we will have to make the adjustment based on our timezone, is that correct ?

9

I don't know anything about your analytics engine and what it expects, but the @timestamp field and everything based on it is UTC.

10

Thank you for the quick response.