# Create index by field value

**URL:** <https://discuss.elastic.co/t/create-index-by-field-value/123943>\
**Category:** Logstash\
**Created:** [March 14, 2018, 3:54pm UTC](https://discuss.elastic.co/t/create-index-by-field-value/123943 "2018-03-14T15:54:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jspeer](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jspeer](https://discuss.elastic.co/u/jspeer)\
**Post date:** [March 14, 2018, 3:54pm UTC](https://discuss.elastic.co/t/create-index-by-field-value/123943/1 "2018-03-14T15:54:48Z")

</div>

I've already setup a template for apache-\*, is it possible to have an index created for a field value that comes in from one of the filebeats clients?

example:

Apache QA servers insert the following field:  
fields: app\_id: apache\_qa

Apache Prod servers insert the following field:  
fields: app\_id: apache\_prod

I would like to index qa data to: apache-qa-%{+YYYY.MM.dd}

I would like to index prod data to: apache-prod-%{+YYYY.MM.dd}

Is this possible, or a better way to setting the index routing? We will have multiple environments, and applications sending to the cluster.

---

<div class="post-metadata">

**Author:** ![jspeer](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jspeer](https://discuss.elastic.co/u/jspeer)\
**Post date:** [March 14, 2018, 4:32pm UTC](https://discuss.elastic.co/t/create-index-by-field-value/123943/2 "2018-03-14T16:32:01Z")

</div>

I was able to get it working, after posting:

index =\> "%{[fields][app\_id]}-%{+YYYY.MM.dd}"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2018, 4:32pm UTC](https://discuss.elastic.co/t/create-index-by-field-value/123943/3 "2018-04-11T16:32:11Z")

</div>

Closed on April 11, 2018, 4:32pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
