Tags from dates

Elastic Stack Beats
1

Hi all,

I would like to tag on a shipper transactions with additional dates, so I tried to run the beat with

tags: ["foo", "baz", "%{+yyyy}","%{yyyy.MM}","%{yyyy.MM.dd}",]

assuming that the variables are evaluated. However, the actual shipped tags are literally the strings "%{+yyyy}" :pensive:

Maybe somebody has an idea for me, what is failing here for me?

Cheers and thanks,
Thomas

2

This is not supported by tags for the add_tags processor. You could probably do this with an Ingest Node processor and the script processor. But maybe using a range query on @timestamp to find those events like @timestamp>2019-01-01 and @timestamp<=2019-01-31 would be better.