UTC date in output filename

Elastic Stack Logstash
1

I am trying to save input date to a file in logstash. The output file has "%{+YYYYMMdd}" appended but this time is UTC time. How can i append file name on local time?

2

You'll have to use a ruby filter to create a field with the local time in whatever format you prefer. I suggest you place that field as a subfield of @metadata so that the field isn't included in the event sent to the output plugin. This has been discussed several times before and I think examples have been posted.

3

Thanks for instant reply. I am saving filenames in below format:

output {
file {
path => "LOG_%{+yyyyMMddHH}"
codec => line { format => "%{[message]}" }
}

Can ruby filter change filenames "yyyyMMddHH" from UTC to local time?

4

Yes, and I have already described the general idea of how to do that.

5

thank you

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.