I have logs that only have a time field i.e. HH:mm:ss.SSS but for some reason there are no dates! I want to include today's date to this field called logstoretime. Because if I do not specify a date filter the time difference from when log gets shipped to when it is processed is to large of a gap ~10minutes. So essentially I want it to log by depending on the day it will pull that date and use my HH:mm:ss.SSS
Yup figured an easy way out ( had this problem earlier in a post...but its time to really fix this issue)
what you can do is add a field
add_field => {"logdate" => "%{+YYYY-MM-dd}"}
I can merge the 2 fields so now the issue is how do I would use a date filter. Because now my issue is when I merge the two fields it becomes an array. What I know from date filter it does not play nicely with arrays. So need to cleanly add this date without turning into a messy array or try and append this field to logstoretime.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.