Time in IST for log-rotation - Logstash

Elastic Stack Logstash
1

I have configured file-beat on all the App servers and Logstash in a centralized server for the log rotation. The config file in Log rotation is

input {
beats {
port => 5044
}
}
filter{
mutate {
remove_field => ["agent","input","host","architecture","containerized","mac","os","@version","log","ecs","offset"]
}
}
output {
file {
path => "/log/sync/ims-v1/%{+dd-MM-yyyy}/%{+HH}-ims.log"
}
}

-- In OUTPUT: Logstash to create a file/directory depending on an hourly basis for the logs: but currently it is creating it in GMT can I do it according to IST.

as: log/sync/ims-v1/12-12-2019/10-ims.log -- Here the 10-ims.log file is getting created at 15:30 IST (According to my use case it should be as: log/sync/ims-v1/12-12-2019/15-ims.log)

Thanks in advance.

2

HI

If what you want is to name your files using the date and time in your local time, you might try something like this:

filter {
  [... your stuff goes here...]
  ruby {
    code => "
      event.set('filename', event.get('@timestamp').time.localtime.strftime('%Y-%m-%d/%H'))
    "
  }
}
	
output {
  file {
    path => "/log/sync/ims-v1/%{filename}-ims.log"
  }
}

Haven't tried this code but I use a similar construct to generate local time from timestamp (or from any date field).

Hope this helps.

3

Thanks alot,

It did worked :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.