Created
July 23, 2020 10:35
-
-
Save mback2k/dc8b69943bfc16daf0974531375d817b to your computer and use it in GitHub Desktop.
Make sure a syslog timestap is in the past, eg. while ingesting archived logs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| filter { | |
| ruby { | |
| code => 'ts=event.get("@timestamp"); if ts.time > Time.now then ts=ts.time.to_a; ts[5]-=1; ts=Time.mktime(*ts); event.set("@timestamp", LogStash::Timestamp.new(ts)) end' | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment