Read logs after a particular day?

(Siddharth Trikha) #1


We have rsyslog creating log files directories like: /var/log/rsyslog/SERVER-NAME/LOG-DATE/LOG-FILE-NAME
So multiple servers are spilling out their logs of different dates to a central location.

Now to read these logs and store them in elasticsearch for analysing I have my logstash config file something like this:

   path => /var/log/rsyslog/**/*.log


Now we want to read log files after a particular date. Eg If in the directory /var/log/rsyslog there are logs of April, May, June 2015 and I want to read all logs after a particular date say > 15.05.2015.

Can this be achieved using logstash file input?

(Mark Walkom) #2

No it cannot.

You could use a drop though to just discard things before this date.

(system) #3