use ruby filter

michaeljguarino · michaeljguarino · commit f65a5add794b · 2026-05-18T22:13:34.000-04:00
diff --git a/services/logstash/logstash.yaml.liquid b/services/logstash/logstash.yaml.liquid
@@ -27,9 +27,8 @@ spec:
           }
         }
         filter {
-          age {}
-          if [@metadata][age] > 86400 {
-            drop {}
+          ruby {
+            code => 'event.cancel if (Time.now.to_f - event.timestamp.to_f) > 86400'
           }
           grok {
             match => { "message" => "%{HTTPD_COMMONLOG}"}

Original file line number	Diff line number	Diff line change
`@@ -27,9 +27,8 @@ spec:`
`27`	`27`	`}`
`28`	`28`	`}`
`29`	`29`	`filter {`
`30`		`- age {}`
`31`		`- if [@metadata][age] > 86400 {`
`32`		`- drop {}`
	`30`	`+ ruby {`
	`31`	`+ code => 'event.cancel if (Time.now.to_f - event.timestamp.to_f) > 86400'`
`33`	`32`	`}`
`34`	`33`	`grok {`
`35`	`34`	`match => { "message" => "%{HTTPD_COMMONLOG}"}`