Logstash hourly rotate file output

filter {
ruby {
code => "event.set('[@metadata][index]', event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d-%H'))"
}
ruby {
code => "event.set('[@metadata][timestamp]', event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d %H:%M:%S.%L'))"
}
}
input {
beats {
port => 1221
}
}
filter {
mutate {
lowercase => [ "[host][name]" ]
}
}
output {
file {
path => "/data/log/%{[host][name]}.server.log.%{[@metadata][index]}"
codec => line { format => "%{[host][name]} %{message}"}
}
}

or use this for daily rotate

ruby {
code => "event.set('[@metadata][index]', event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d'))"
}

Done. it’s easy when you know it.

refer: https://discuss.elastic.co/t/timezone-in-utc-causes-wrong-filename/261480

--

--

--

Very short and simple notes for CKA/SRE and may not works on your environment.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

How to Print Documents with Angular

Introduction of JavaScript

Graphical representation of how execution context work behind the scene

譜 (Japanese Kanji) — musical score, music, note, staff, table, genealogy

Day 4 — #100DaysOfCode

What do you know about Quantum Computing?

>【数码宝贝:最后的进化 】完整版本[2020~HD]-《Digimon Adventure: Last Evolution Kizuna 》電影在線完整版-HD-BLURAY.<

10 Basic Topics of JavaScript For Beginners

TEN Stack: Typescript-Express-Node template

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Jbn1233

Jbn1233

Very short and simple notes for CKA/SRE and may not works on your environment.

More from Medium

High Availability on NGINX

DesktopInfo — Conky for Windows

Automatic versioning V2