Logstash S3 input plugin - filter based on time modified

Elastic Stack Logstash
6

I see it! Looking at your data again it looks like last_modified is already being recognized as a timestamp type of field as there are no " " around the value. That's good! You can just rename or copy the field then using a mutate filter. No need for the date filter at all :smiley:

mutate {
   copy => { "[@metadata][s3][last_modified]" => "s3time"}
   copy => { "@timestamp" => "processed_time"}
   copy =>  {"[@metadata][s3][last_modified]" => "@timestamp"}
}

Not sure if this code will work exactly as I don't have a logstash instance in front of me... play around with it.