# Best practice for setting index names when using filebeats to logstash
**URL:** https://discuss.elastic.co/t/best-practice-for-setting-index-names-when-using-filebeats-to-logstash/117597
**Category:** Beats
**Tags:** filebeat
**Created:** [January 30, 2018, 10:02am UTC](https://discuss.elastic.co/t/best-practice-for-setting-index-names-when-using-filebeats-to-logstash/117597 "2018-01-30T10:02:49Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@David\_Gidony](https://discuss.elastic.co/u/David_Gidony)
#### Post date: [January 30, 2018, 10:02am UTC](https://discuss.elastic.co/t/best-practice-for-setting-index-names-when-using-filebeats-to-logstash/117597/1 "2018-01-30T10:02:50Z")
hi,
i a monitoring a log directory with filebeats, this directory has severl log files, how can i send a specific log file to a specific index in elasticsearch when going through logstash?
fileBeats settings:
filebeat.prospectors:
- type: log
enabled: true
paths:
- C:\DCAlogs\dca.process-\*.log
output.logstash:
hosts: ["localhost:5044"]
example of log file names
dca.process-aTob.log
dca.process-errorlist.log
dca.process-test\_log.log
in my current flow, they will all go to the same index.
i'm a noob to the elk world, but i think best practice would be to save each in its own index,
how can i do that
thanks.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [January 30, 2018, 2:32pm UTC](https://discuss.elastic.co/t/best-practice-for-setting-index-names-when-using-filebeats-to-logstash/117597/2 "2018-01-30T14:32:43Z")
In logstash you can configure the index name to be dynamic, based on the events contents. See [Set up Logstash docs](https://www.elastic.co/guide/en/beats/libbeat/6.1/logstash-installation.html#logstash-setup). The `@metadata` fields is published by filebeat with the event. It contains the beat name, a `type` field and the `beat` version. But you are free to use any field you want to.
In LS you can filter on tags or fields. E.g. the `source` field contains the filename. But you can also setup different prospectors per file-type and add tags or extra fields in order to configure the index name to be used by LS.
---
### Author:  [@David\_Gidony](https://discuss.elastic.co/u/David_Gidony)
#### Post date: [February 4, 2018, 10:33am UTC](https://discuss.elastic.co/t/best-practice-for-setting-index-names-when-using-filebeats-to-logstash/117597/4 "2018-02-04T10:33:44Z")
hi,
i dont know how to access the source filed, i've tried:
mutate {
add\_field =\> { "filename" =\> [source] }
and
add\_field =\> {[fields][source]}
and
add\_field =\> {"%{[fields][source]}"}
}
nothing seems to work
can you please provide an example.
creating a index with a filename reference, or even better, adding file name as a new field,
thanks,
David
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 4, 2018, 10:33am UTC](https://discuss.elastic.co/t/best-practice-for-setting-index-names-when-using-filebeats-to-logstash/117597/5 "2018-03-04T10:33:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.