Read latest logs from a file

Elastic Stack Beats
1

Hello Folks,

I have one log file and it is containing all logs since November 2025 to till now. For doing the parsing of logs i’ve copy-paste sample logs to test.log file and it worked. My question is

  1. How to read last 3 days of logs ?(As the user have one single log file which is not rotating)
  2. Or How to read latest logs.

I have used ignore_older option but it give me all the logs because i have copy paste sample logs .I have used tail option it worked . Is there any other way to read

2

Hello @Aniket_Pant

I believe there are 2 ways :

  1. Is to dissect & drop the messages :
processors:
  - grok:
      field: message
      patterns:
        - '%{TIMESTAMP_ISO8601:log_timestamp} %{GREEDYDATA:msg}'

  - date:
      field: log_timestamp
      target_field: "@timestamp"
      formats:
        - ISO8601

  - drop_event:
      when:
        range:
          "@timestamp":
            lt: "now-3d"

2. Index all the data & delete older data from index :

POST your-index-name/_delete_by_query
{
  "query": {
    "range": {
      "@timestamp": {
        "lt": "now-3d"
      }
    }
  }
}

Thanks!!