# Change the stream names

**URL:** <https://discuss.elastic.co/t/change-the-stream-names/327153>\
**Category:** Endpoint Security\
**Created:** [March 7, 2023, 8:04am UTC](https://discuss.elastic.co/t/change-the-stream-names/327153 "2023-03-07T08:04:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bex](https://avatars.discourse-cdn.com/v4/letter/b/4bbf92/32.png) [@bex](https://discuss.elastic.co/u/bex)\
**Post date:** [March 7, 2023, 8:04am UTC](https://discuss.elastic.co/t/change-the-stream-names/327153/1 "2023-03-07T08:04:29Z")

</div>

Is it possible to change or indicate the stream(index) name like "index =\> "client-1-%{+dd.MM.YYYY}" when using fleet server and elastic agent in logstash output.  
There are streams with default name like "logs-auditd.log-default"  
 ![default-name of stream](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c9d207ec270fbbe55201af13d8284545a13b30a4.jpeg)

 ![logstash output](https://us1.discourse-cdn.com/elastic/original/3X/7/a/7a968caef3e10b1b0f10f10634a4474855b08d39.jpeg)

---

<div class="post-metadata">

**Author:** ![j0rj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/j0rj/32/100450_2.png) [@j0rj](https://discuss.elastic.co/u/j0rj)\
**Post date:** [March 7, 2023, 8:34am UTC](https://discuss.elastic.co/t/change-the-stream-names/327153/2 "2023-03-07T08:34:12Z")

</div>

You can change the [DataStream's](https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme) 3rd part, the Namespace, to specify a custom client name.

You can do it in Logstash, in case you needed to retrieve a client name from the Log itself

```auto
filter {
    mutate {
        update => { "[data_stream][namespace]" => "%{[client][name]}" }
      }
}

```

Or directly in the fleet Integration if you are installing an agent for each client.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11a385316a108395aaf735b3e7af15b39473c67e.png)

---

<div class="post-metadata">

**Author:** ![bex](https://avatars.discourse-cdn.com/v4/letter/b/4bbf92/32.png) [@bex](https://discuss.elastic.co/u/bex)\
**Post date:** [March 7, 2023, 8:53am UTC](https://discuss.elastic.co/t/change-the-stream-names/327153/3 "2023-03-07T08:53:59Z")

</div>

Hello @j0rj. Thanks for reply.

Do you know where I can add the date to the datastream.  
Or is it possible to add like:

```auto
filter {
     mutate {
        update => { "[data_stream][namespace]" => "%{[client][name]}-%{+dd.MM.YYYY}" }
      }
}

```

---

<div class="post-metadata">

**Author:** ![j0rj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/j0rj/32/100450_2.png) [@j0rj](https://discuss.elastic.co/u/j0rj)\
**Post date:** [March 7, 2023, 9:15am UTC](https://discuss.elastic.co/t/change-the-stream-names/327153/4 "2023-03-07T09:15:30Z")

</div>

Adding the dates in here would affect how the ILM rollover works, as you will enforce a daily new index (regardless of it's size, can be 1Gb or 100GB) instead of letting ILM policy rollover action take care of that and be certain a new index will only be created when specific parameter is reached (size, docs, age...)

If you add it that way, and remove the Enrollment action from the ILM Policy Hot Phase, it might work fine for you, but needs to be tested if it cause any other issues that needs to be edit somewhere else as well.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b62e8e81fde24f40d160c76ce116ca4552476248.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2023, 9:16am UTC](https://discuss.elastic.co/t/change-the-stream-names/327153/5 "2023-04-04T09:16:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.