# An index per host

**URL:** <https://discuss.elastic.co/t/an-index-per-host/156124>\
**Category:** Logstash\
**Created:** [November 10, 2018, 4:49am UTC](https://discuss.elastic.co/t/an-index-per-host/156124 "2018-11-10T04:49:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vman](https://avatars.discourse-cdn.com/v4/letter/v/5e9695/32.png) [@vman](https://discuss.elastic.co/u/vman)\
**Post date:** [November 10, 2018, 4:49am UTC](https://discuss.elastic.co/t/an-index-per-host/156124/1 "2018-11-10T04:49:34Z")

</div>

if [host] in ["host1", "host2", "host3" , "host4" , "host5"] {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
...  
index =\> "host1-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
} else {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
...  
index =\> "host2-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
} else {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
...  
index =\> "host3-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
} else {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
...  
index =\> "host4-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
} else {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
...  
index =\> "host5-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

Can this be achieved?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 10, 2018, 8:14am UTC](https://discuss.elastic.co/t/an-index-per-host/156124/2 "2018-11-10T08:14:40Z")

</div>

If you have the hostname as a field:value pair, why not just use that as a variable in the index name?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 10, 2018, 9:08am UTC](https://discuss.elastic.co/t/an-index-per-host/156124/3 "2018-11-10T09:08:15Z")

</div>

You can not have conditionals within a plugin, but can do something like this:

```auto
if [host] in ["host1", "host2", "host3" , "host4" , "host5"] {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "%{[host]}-%{+YYYY.MM.dd}"
  }
} else {
  elasticsearch {
    hosts => ["localhost:9200"]
     index => "default-%{+YYYY.MM.dd}"
  }
}

```

Having lots of small indices and shards in a cluster [can however be very inefficient](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster) and cause performance problems, so you should ask yourself if this really is necessary. If you still decide to to this, which I generally would not recommend, you probably want to reduce the number ion primary shards per index and consider using monthly rather than daily indices if you intend to keep your data for an extended period.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2018, 9:18am UTC](https://discuss.elastic.co/t/an-index-per-host/156124/4 "2018-12-08T09:18:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.