Need help to create current date based Index in LS

Elastic Stack Logstash
1

Hi Experts,

I am aware that I can use following to create date index .
index => "prod-%{+YYYY.MM.dd}" but the problem is, it is picking up logs date rather current date, what I want is to create index on current date basis. Please suggest how I can achieve this ?

Thanks
VG

2

I don't understand why you'd want to do that, but the easiest way is probably to store today's date in a @metadata field and reference that field in the output. Something like this:

filter {
  ruby {
    code => "event['@metadata']['now'] = Time.new.strftime('%Y-%m-%d')"
  }
}
output {
  elasticsearch {
    ...
    index => "prod-%{@[metadata][now]}"
  }
}
3

@magnusbaeck,

Thank you for quick response , with above index is getting created but as follows

Index name Doc Count
prod-%{[metadata][now]} 7089

Actually my requirement is to just create index on current date , something like prod-2-26-2016

4

I get it @ was missing , thanks it works

5

Yes, sorry. I updated the post.