add hours to index name

[Alisher-Nabiev]

i am trying to configuring my index like this

output {
elasticsearch {
host => 0.0.0.0
port => 9200
bulk_limit => 1000
bulk_timeout => 100
pipeline => imei-pipeline
index_prefix => "netflow-%{+YYYY-MM-dd.HH}"
data_type => netflow
}
}

but it now working i tried to run the DEBUG and its shows like evriting is ok but still don't receive any doc to my index.

it work for me only like this:
output {
elasticsearch {
host => 0.0.0.0
port => 9200
bulk_limit => 1000
bulk_timeout => 100
pipeline => imei-pipeline
index_prefix => netflow
data_type => netflow
}
}

also tried this conf:
output {
elasticsearch {
host => 0.0.0.0
port => 9200
bulk_limit => 1000
bulk_timeout => 100
pipeline => imei-pipeline
index => netflow-%{+YYYY-MM-dd.HH}
data_type => netflow
}
}

also don't work

[lmangani]

The format you're using doesn't seem to be valid. Try something like #{now:YYYY-MM-dd.HH}

[Alisher-Nabiev]

like this? index_prefix => netflow-{now:YYYY-MM-dd.HH}
it doesn't work
also this
index_prefix => netflow-{YYYY-MM-dd.HH}
also this
index_prefix => "netflow-%{now:YYYY-MM-dd.HH}"

this configuration index => netflow-%{+YYYY-MM-dd.HH} working for me on logstash in another service

[lmangani]

This is not logstash. The syntax is different and needs to be followed. In your example above it seems you did not.

index => 'netflow-#{now:YYYY-MM-dd.HH}'

[Alisher-Nabiev]

still not working do i need add in the filter this?

filter {
date {
match => ["EventTime", "UNIX_MS" ]
target => "@timestamp"
}

[lmangani]

It works fine for me. The date format is from the 'moment' library

 compute_field {
    field => index
    value => 'test-#{now:YYYY}'
  }

{
  "source": "stdin",
  "message": "test",
  "@timestamp": "2024-08-05T14:24:06.064Z",
  "type": "stdin",
  "index": "test-2024"
}