Create index by field value

Elastic Stack Logstash
1

I've already setup a template for apache-*, is it possible to have an index created for a field value that comes in from one of the filebeats clients?

example:

Apache QA servers insert the following field:
fields: app_id: apache_qa

Apache Prod servers insert the following field:
fields: app_id: apache_prod

I would like to index qa data to: apache-qa-%{+YYYY.MM.dd}

I would like to index prod data to: apache-prod-%{+YYYY.MM.dd}

Is this possible, or a better way to setting the index routing? We will have multiple environments, and applications sending to the cluster.

2

I was able to get it working, after posting:

index => "%{[fields][app_id]}-%{+YYYY.MM.dd}"

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.