Search code examples
elasticsearchtimestampmappinglogstashlogstash-configuration

Logstash write Elasticsearch Index in the Future

We have this weird hacky workaround involving writing to an index that is dated in the future.

I'm trying to set up logstash in order to do this, but I'm not even sure if its possible.

                      elasticsearch {
                           index => "logstash-%{+YYYY.MM.dd}"
                  }

Is there a way to modify this to so that I simultaneously write to an index that is also 7 days in the future?

Solution

  • You can have a second elasticsearch{} output stanza, using an index with a future date. To generate the date, drop into the ruby{} filter and add 7 days to @timestamp.