Reading previous week indice with elastic input plugin


#1

Hello,
today, a mystery...

How to read only the previous week indice of Elastic using input plugin Elastic (in logstash conf).
For example, today just the 40th week.

The actives indices are :
data_test-2017.39
data_test-2017.40
data_test-2017.41

I'm trying this but without good result :


input {
elasticsearch {
hosts => ["SRV1001:9200"]
index => "data_test-%{+YYYY.ww}-1"
... }

and too :
index => "data_test-%{+YYYY.ww-1}"
index => "data_test-%{+xxxx.ww-1}"


i always obtain : "status":404
There is a solution?

my logstash version is 2.4.1
Thanks.


(Mark Walkom) #2

You can't do that sort of date math in the output unfortunately.


#3

well, it means that there is no solution to do that (select the previous week's indice) !?
Surprising !


#4

hi,
If someone is looking for an answer, look at this, it's mine !

config logstash plugin :
input {
elasticsearch {
hosts => ["SRV1001:9200"]
index => "data_test-${an}.${nbELK:NOVAL}"
}
}
...
Here, i'm using two SYSVAR called "an" and "nbELK" and that are declared in advance.
Be careful, in Logstash version 2.41, you must execute with the flag "--allow-env"
like this >>> logstash -f ficLogstash.conf --allow-env

It's OK on Windows env. Probably no problem also on Linux...


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.