Search code examples
filelogstashdatecreateddatemodified

Get file's last modification date with Logstash

Is there a way for Logstash to get the date at which a file has been last modified?

In Linux, this would correspond to the date -r command.

Solution

  • Logstash does not expose this by default, but you can do just about anything with a ruby filter. A quick Google search find: Is it possible to read a file's modification date with Ruby?

    Logstash does expose the name of the file as part of the event, so putting it together, we'd get:

    ruby {
  code => 'event["mtime"] = File.mtime(event["path"])'
}

    I've never tried this, so I might have missed something.