Need advice in logstash to dynamicly output csv file name based on weekly timestamp

Elastic Stack Logstash
1

So i'm doing a csv output automation where i want my exported csv file to be named like
data-2019.07.01.csv
but naming/creating the new file only occur every monday (weekly) so the file will contain data from July 1st-7th,
and the next monday logstash would create:
data-2019.07.08.csv (will contain data from july 8th-14th).

Maybe odd, but i'm thinking like adding new field which has value day of year like:
day: "Mon"

so when it's monday the output will be like:
path => "/tmp/data-%{+yyyy.MM.dd}"

but on other day like:
day: "Tue"

the output will be like:
path => "/tmp/data-%{+yyyy.MM.**(dd-1)**}"

The whole output will be like:

output {
  if [day] == "Mon"
    csv {
      path => "/tmp/data-%{+yyyy.MM.dd}"
    }
  } else if [day] == "Tue" {
    csv {
      path => "/tmp/data-%{+yyyy.MM.(dd-1)}"
    }
  } else if [day] == "Wed" {
    csv {
      path => "/tmp/data-%{+yyyy.MM.(dd-2)}"
    }
  }  ... and so on
}

*Event better if the file could be named data-2019.07.01-2019.07.07.csv.

is that close to posibility? Hope someone can help. thanks in advance.

2

Apologies if looking at my ruby code makes your eyeballs bleed, but this will do it

    ruby {
        code => '
            def date_of_prev(day)
                date  = Date.parse(day)
                # <= means if today is the day we return today
                delta = date <= Date.today ? 0 : -7
                date + delta
            end

            dThis = date_of_prev "Wednesday"
            dNext = (dThis + 7).strftime "%Y.%m.%d"
            dThis = dThis.strftime "%Y.%m.%d"
            event.set("[@metadata][indexname]", "#{dThis}-#{dNext}")
        '
    }
4

sorry i edited my question on title and the body cause some typo, i will definitely try in the office tomorrow

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.