Append hostname in each index name

I would like to append hostname in each index name for classification of files based on the source hostname.

  elasticsearch {
    hosts => [""]
    index => "sample-%{[@metadata][hostname]}-%{[@metadata][beat]}-%{[@metadata][version]}-soap2-%{[@metadata][beat]}-%{+YYYY.MM.dd}"

This metadata is not working %{[@metadata][hostname]};

You might not have a field called hostname.

Add this to your output and it will show you all the metadata fields available.

stdout { codec => rubydebug { metadata => true } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.