# Create custom index using custom mapping field via logstash

**URL:** <https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757>\
**Category:** Logstash\
**Created:** [October 30, 2017, 11:42am UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757 "2017-10-30T11:42:12Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aner\_Izraeli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aner_izraeli/32/23557_2.png) [@Aner\_Izraeli](https://discuss.elastic.co/u/Aner_Izraeli)\
**Post date:** [October 30, 2017, 11:42am UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/1 "2017-10-30T11:42:12Z")

</div>

Hello there,  
im using logstash with matching my custom fields via multigrok.conf.  
example:

match =\> { "message" =\> "(?\<log\_type\>AUTORUN) (?.\*?)|%{IPORHOST:machineName}|%{DATA:userName}|%{DATA:domainname}|%{DATA:os}|%{IPORHOST:machineName2}|%{IP:ipaddress}|%{DATA:keyName}|%{DATA:keyData}|%{WORD:hash}|%{WORD:keyType}" }

currently my index created under logstash-\*

can i automatically create a custom index using one of the custom matching fields in my multigrok.conf? 'domainname' for instance?

output {  
elasticsearch {  
hosts =\> ["[https://cloud/](https://cloud/)" ]  
#index =\> "domainname"

```
}

```

tried and did not work.  
Thanks!

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [October 30, 2017, 11:48am UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/2 "2017-10-30T11:48:18Z")

</div>

You need to reference the field properly (as it is, it's just a string value).

```auto
output {
  elasticsearch {
     hosts => ["https://cloud/"]
     index => "%{domainname}"
  }
}
```

---

<div class="post-metadata">

**Author:** ![Aner\_Izraeli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aner_izraeli/32/23557_2.png) [@Aner\_Izraeli](https://discuss.elastic.co/u/Aner_Izraeli)\
**Post date:** [October 30, 2017, 1:18pm UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/3 "2017-10-30T13:18:23Z")

</div>

> [@paz](#):
>
> "%{domainname}"

Thanks!  
should i create an index pattern of \*?  
should i change anything at "advanced settings"?

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [October 30, 2017, 1:28pm UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/4 "2017-10-30T13:28:22Z")

</div>

You shouldn't really need to change any advanced settings for it to work.  
Those are usually for specific use-cases or performance tuning. If it works nicely for you, I'd say don't do so (unless you want to experiment).

As for the index pattern, it's just a matter of preference. If you want your indices to be named just based on the domain name, or append a prefix or anything. There is no set rule on this.

---

<div class="post-metadata">

**Author:** ![Aner\_Izraeli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aner_izraeli/32/23557_2.png) [@Aner\_Izraeli](https://discuss.elastic.co/u/Aner_Izraeli)\
**Post date:** [October 30, 2017, 2:07pm UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/5 "2017-10-30T14:07:36Z")

</div>

Hmmm ok  
but if so, my only index i have is logstash-\*  
via kibana`s discover i really cant search other index since logstash-\* is the only option.

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [October 30, 2017, 2:21pm UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/6 "2017-10-30T14:21:17Z")

</div>

Oh I thought you meant in Logstash configuration.  
For Kibana to discover your indices you do need to set an index pattern of \* (as in "fetch everything").

---

<div class="post-metadata">

**Author:** ![Aner\_Izraeli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aner_izraeli/32/23557_2.png) [@Aner\_Izraeli](https://discuss.elastic.co/u/Aner_Izraeli)\
**Post date:** [October 30, 2017, 2:40pm UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/7 "2017-10-30T14:40:28Z")

</div>

Yeah just did and it works great!  
Thank you very much!

---

<div class="post-metadata">

**Author:** ![Aner\_Izraeli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aner_izraeli/32/23557_2.png) [@Aner\_Izraeli](https://discuss.elastic.co/u/Aner_Izraeli)\
**Post date:** [October 30, 2017, 2:56pm UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/8 "2017-10-30T14:56:58Z")

</div>

Hii again,  
so a new \_index was created. new index name is "aner-new-index"  
i can see it in my events via discover.  
now i want to grant a user priv based on that new index.  
however, the only indices i have are \* and logstash-\*  
can`t see "aner-new-index". what`s missing here?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2017, 2:57pm UTC](https://discuss.elastic.co/t/create-custom-index-using-custom-mapping-field-via-logstash/105757/9 "2017-11-27T14:57:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.