Time in IST for log-rotation - Logstash

[singhankit.iem (Ankit Kumar Singh)]

I have configured file-beat on all the App servers and Logstash in a centralized server for the log rotation. The config file in Log rotation is

input {
beats {
port => 5044
}
}
filter{
mutate {
remove_field => ["agent","input","host","architecture","containerized","mac","os","@version","log","ecs","offset"]
}
}
output {
file {
path => "/log/sync/ims-v1/%{+dd-MM-yyyy}/%{+HH}-ims.log"
}
}

-- In OUTPUT: Logstash to create a file/directory depending on an hourly basis for the logs: but currently it is creating it in GMT can I do it according to IST.

as: log/sync/ims-v1/12-12-2019/10-ims.log -- Here the 10-ims.log file is getting created at 15:30 IST (According to my use case it should be as: log/sync/ims-v1/12-12-2019/15-ims.log)

Thanks in advance.

[ITIC (Jordi)]

HI

If what you want is to name your files using the date and time in your local time, you might try something like this:

filter {
  [... your stuff goes here...]
  ruby {
    code => "
      event.set('filename', event.get('@timestamp').time.localtime.strftime('%Y-%m-%d/%H'))
    "
  }
}
	
output {
  file {
    path => "/log/sync/ims-v1/%{filename}-ims.log"
  }
}	

Haven't tried this code but I use a similar construct to generate local time from timestamp (or from any date field).

Hope this helps.

[singhankit.iem (Ankit Kumar Singh)]

Thanks alot,

It did worked