I am trying to write a .conf file to automatically build monthly indexes.
I've read that Logstash uses @timestamp to identify the month of a document and that this field is in UTC by default.
- I'm in a timezone different from UTC and
- I want to use a different time field "mytime" to identify the month of a document.
I'm trying to use the date plugin to replace the value of @timestamp with the value of "mytime".
filter {date {
match => [ "mytime" , "ISO8601" ]
timezone => "Europe/Madrid"
target => "@timestamp"}}output {
elasticsearch {
index => "myindex-%{+YYYY.MM}"
}}
However, this produces the following error:
[INFO ] 2020-09-18 14:17:23.321 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>}
[INFO ] 2020-09-18 14:17:23.457 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[ERROR] 2020-09-18 14:17:27.478 [[main]>worker3] ruby - Ruby exception occurred: can't convert String into an exact number
Any suggestions?
Thans in advance