Logstash S3 output prefix - Event field timestamp

Elastic Stack Logstash
1

How to set Logstash S3 output prefix dynamically with an event field value in format: "%{+YYYY}/%{+MM}/%{+dd}/%{+HH}" ?


input:
{"record_time":"2017-03-09T04:07:51.520Z"}

required s3 prefix: 
2017/03/09/04
2

The output sprintfs the prefix, so you can use

prefix => "%{+YYYY}/%{+MM}/%{+dd}/%{+HH}"
3

But this is taking @timestamp value I believe. But I want to use record_time field value from event.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.