# Can I substring event data's value and use this in elasitcsearch index name in logstash config?
**URL:** https://discuss.elastic.co/t/can-i-substring-event-datas-value-and-use-this-in-elasitcsearch-index-name-in-logstash-config/195012
**Category:** Logstash
**Created:** [August 13, 2019, 11:33am UTC](https://discuss.elastic.co/t/can-i-substring-event-datas-value-and-use-this-in-elasitcsearch-index-name-in-logstash-config/195012 "2019-08-13T11:33:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@teemoGod](https://discuss.elastic.co/u/teemoGod)
#### Post date: [August 13, 2019, 11:33am UTC](https://discuss.elastic.co/t/can-i-substring-event-datas-value-and-use-this-in-elasitcsearch-index-name-in-logstash-config/195012/1 "2019-08-13T11:33:39Z")
following is my config
```auto
input {
file {
path => "/*.log"
start_position => "beginning"
sincedb_path => "/sincedb.log"
exclude => ["*current.log", "*sincedb.log"]
}
}
filter {
json {
source => "message"
# add_field => { "new_field2" => "My name is %{controller}" }
remove_field => ["message"]
}
}
output {
elasticsearch {
hosts => "http://127.0.0.1:9200"
index => "log_${???}" # what i want to know
codec => "json"
}
}
```
- input
i'm reading multiple json lines in multiple files. (read mode)
in these json strings including 'date' property (yyyy-MM-dd HH:mm:ss)
- filter
i added logstash's `message` to `source` and delete `message`
- output
i want to insert this log into 'log\_2019.08.13' index in elasticsearch.
i has created indices name with server date.
but, sometime 'date' key's value in log and actual server time is not same.
for example, value about log's 'date' key is '2019-08-12 23:59:59'.
but when this logs going in index, and server time has changed to next day,
this log will be come to 'log\_2019.08.13'. so, my aggregation result has lower correctness.
so, i decided to make index name's date 'yyyy.MM.dd' format via log's 'date' field.
how can i substring(for substring ' HH:mm:ss', 'yyyy-MM-dd')
and join(for join "yyyy + '.' + MM + '.' + dd")
and use in index name in logstash config?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 13, 2019, 12:47pm UTC](https://discuss.elastic.co/t/can-i-substring-event-datas-value-and-use-this-in-elasitcsearch-index-name-in-logstash-config/195012/2 "2019-08-13T12:47:47Z")
If you use a time reference in the index name, like "logstash-%{+YYYY.MM.dd}", then the YYYY, MM, and dd values are extracted from the [@timestamp] field of the event. So you just need a [date](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) filter to parse your date field into @timestamp.
---
### Author:  [@teemoGod](https://discuss.elastic.co/u/teemoGod)
#### Post date: [August 14, 2019, 1:13am UTC](https://discuss.elastic.co/t/can-i-substring-event-datas-value-and-use-this-in-elasitcsearch-index-name-in-logstash-config/195012/3 "2019-08-14T01:13:11Z")
@Badger thx for your response.
i will test and reply later.
---
### Author:  [@teemoGod](https://discuss.elastic.co/u/teemoGod)
#### Post date: [August 20, 2019, 4:20am UTC](https://discuss.elastic.co/t/can-i-substring-event-datas-value-and-use-this-in-elasitcsearch-index-name-in-logstash-config/195012/4 "2019-08-20T04:20:39Z")
@Badger, your suggestion is working perfectly as i intended. thx.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 17, 2019, 4:20am UTC](https://discuss.elastic.co/t/can-i-substring-event-datas-value-and-use-this-in-elasitcsearch-index-name-in-logstash-config/195012/5 "2019-09-17T04:20:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.