Accessing Metafield _index in Logstash

I am using this output for Elasticsearch

index => "%{[headers][key]}-data-%{+YYYY.MM}"

So it creates a index name with the date added. I am trying to reindex this data through a logstash filter. So I am using the previous index as an input to logstash and trying to output the data to the same name while appending a reindexed value.

index => "%{[_index]}-reindexed"

It says this is a Meta field. Do I need to do something different to access it? I have also tried

index => "%{[@metadata][_index]}-reindexed"

If you are using an elasticsearch input and want to reference the name of the index from which data was fetched you need to set

docinfo => true

on the input. And yes, you would reference [@metadata][_index].

Thanks for the reply. I looked up the documentation on that after your post. I now have

input {
  elasticsearch {
   hosts => ["address"]
   index => "index-name*"
   docinfo => true
  }
}

filter{
some logic
}

output {
 elasticsearch {
      hosts => ["address"]
      index => "copy-of-production.%{[@metadata][_index]}"
   }
   
     stdout { codec => rubydebug {} }
}

I am just getting this as the index name for the output - "copy-of-production.%{[@metadata][_index]}"

Is there something I am missing. Thanks

Your advice worked this with a newer version of Logstash. Thanks again for the help.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.