how to use logstash input elasticsarch index dynamic value

Question

Please help me.

What I want is to know how to dynamically change the index during logstash elasticsearch input.

i want this

input {
    elasticsearch {
        hosts => localhost:9200
        index => index-+{yyyy}-{increasing value}
    }
}

result

input {
    elasticsearch {
        hosts => localhost:9200
        index => index-2022-52
    }
}

I need to be able to set the value to change every day.

ex) Using Linux scripts

Thank you in advance for your help.

score 0 · Answer 1 · answered Mar 28 '22 at 06:45

0

Your input configuration would look like this:

input {
    elasticsearch {
        hosts => localhost:9200
        index => index-${YEAR}-${SEQ}
    }
}

And then set those variables from your shell just before running Logstash

export YEAR=2022
export SEQ=52

./bin/logstash -f test.conf

answered Mar 28 '22 at 06:45

Val

When logstash is running, how can I change it? – vane Mar 28 '22 at 06:54
You can't. However, it is not possible that Logstash keeps running with an `elasticsearch` input. Logstash will run the query against ES, receive the documents, process them and stop. – Val Mar 28 '22 at 06:55
thank you!! is it the same when using a pipeline? – vane Mar 28 '22 at 07:09
It makes no difference, it's the nature of how the `elasticsearch` input works. – Val Mar 28 '22 at 07:14

1 Answers1