Skip to content

Instantly share code, notes, and snippets.

@mback2k

mback2k/logstash-ruby-fix-timestamp.conf

Created July 23, 2020 10:35
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mback2k/dc8b69943bfc16daf0974531375d817b to your computer and use it in GitHub Desktop.
Save mback2k/dc8b69943bfc16daf0974531375d817b to your computer and use it in GitHub Desktop.
Download ZIP
Make sure a syslog timestap is in the past, eg. while ingesting archived logs
Raw
logstash-ruby-fix-timestamp.conf
filter {
ruby {
code => 'ts=event.get("@timestamp"); if ts.time > Time.now then ts=ts.time.to_a; ts[5]-=1; ts=Time.mktime(*ts); event.set("@timestamp", LogStash::Timestamp.new(ts)) end'
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment