Under the sprintf section of Accessing Event Data and Fields in the Configuration in the logstash reference. There is mention of being able to use a +FORMAT to format the @timestamp..in their example they mention using it for outputting logs to a file based on the events date and hour.
https://www.elastic.co/guide/en/logstash/7.1/event-dependent-configuration.html#sprintf
Lets take for instance, the following config...
input {
stdin { }
}
filter {
mutate {
add_field => {
"[date_pattern]" => "+YYYY.MM"
}
}
mutate {
add_field => {
"[year_month]" => "%{[date_pattern]}"
"[year_month2]" => "%{+YYYY.MM}"
}
}
}
output {
stdout {
codec => rubydebug
}
}
Followed by the results...
{
"year_month" => "+YYYY.MM",
"year_month2" => "2019.06",
"@timestamp" => 2019-06-04T16:11:38.858Z,
"date_pattern" => "+YYYY.MM",
"@version" => "1",
"host" => "test.server.com",
"message" => ""
}
I was hoping that year_month would have expanded date_pattern and would yield the same result as year_month2.
Thoughts?
Is there a way to achieve this?