You can refer Hdfs sink timestamp escape sequence , there is alot of them you can use accordingly .    example  U can use hdfs bucketing , for every one hour.  agen1.sinks.hdfsSinks.hdfs.path = /data/flume/%{aa}/%y/%m/%d/%H/%M agent1.sinks.hdfsSinks.hdfs.round = true agen1.sinks.hdfsSinks.roundUnit = hour agen1.sinks.hdfsSinks.roundValue = 1 ... View more