Get file's last modification date with Logstash

Question

Is there a way for Logstash to get the date at which a file has been last modified?

In Linux, this would correspond to the date -r command.

I don't get the down vote. This is a genuine and precise question and I don't see how I could add more info to it. — halpsb, Apr 30 '15 at 13:23

score 2 · Accepted Answer · edited May 23 '17 at 12:14

Logstash does not expose this by default, but you can do just about anything with a ruby filter. A quick Google search find: Is it possible to read a file's modification date with Ruby?

Logstash does expose the name of the file as part of the event, so putting it together, we'd get:

ruby {
  code => 'event["mtime"] = File.mtime(event["path"])'
}

I've never tried this, so I might have missed something.

1 Answers1