[Solved] [Logstash] Elasticsearch output plugin question

Elastic Stack Logstash
1

Hi all,

I'm new here, so hello to everybody !!!

I have a question regarding the elasticsearch output plugin.

When I set the index, what is the base of the macro %{+YYYY.MM.dd} ?
index => "logstash-%{+YYYY.MM.dd}"

This is the local time, or it's from the @timestamp field or something else ?

Thanks in advance.

Alex

2

It's from the @timestamp field. See https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf.

3

Thanks a lot for you quick answer !

It's very helpful.