Use current time / system time in logstash file output?

Elastic Stack Logstash
1

Hi,

Today we are using these kind of logstash file outputs,

path => "/mnt/%{[project]}/%{[instance]}/%{[beat][hostname]}/%{[logtype]}/%{+YYYY}/%{+MM}/%{+dd}/%{[log_filename]}"

but we can't use the date filter. We need logstash to use the current date and time. Is there any way to do this?

Best Regards,
Bjorn

2

Hi.
I am not sure if I am understanding your question right.
You want the custom file name that consists with the current time of the event as it is being processed?

3

Hi,

I want the date / time in the custom file name to be the exact date / time when logstash writes the event to the file, nothing else. We are writing to a tamper proof area and have to use the current date / time.

4

It uses always the time from the system. so it uses the actual date and time.

why cant you use the date filter?

5

Hi logger,

Well, not really... Read Magnus answer in this thread,

https://discuss.elastic.co/t/add-field-timestamp-with-current-time/59862

I will try a ruby filter.

6

Ok, I thought it would be good if it uses the timestamp of the logs. so that slow processed logs will be still written to the file of the day.

Like an event which was created at 23:59:59 but will be parsed from logstash at 00:00:01 would still be saved in the file from yesterday.

If you take the ruby filter it will be saved to the new day.

7

I can't do that. I got to have the timestamp of the log and the file name / folder structure separated. As I wrote before, we are writing to a tamper proof area and I will get an access denied if I try to write a queued event with an "old timestamp".

8

Ok, sorry. Hope it will work. :+1:

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.