# Create index for filebeat with idicated host or log path **URL:** \ **Category:** Kibana\ **Created:** [October 21, 2020, 1:26pm UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840 "2020-10-21T13:26:00Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [October 21, 2020, 1:26pm UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/1 "2020-10-21T13:26:01Z")
Hi, I'm new in ELK and my main goal is to share logs for created users from different hosts. So at this moment I have two hosts A and B where I installed and configured filebeat. I need to create index for filebeat, but divided for each host. I create role and spaces for different logs but can't use log from specific host Trying many options but I can't find solution. I would be grateful for the advice ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [October 21, 2020, 2:40pm UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/2 "2020-10-21T14:40:57Z")
Excessive splitting of logs to multiple indices can lead to problems later, too many shards causes more problems than a few large shards. That said, I don't see enough here to understand the problem. Are your host logs getting to the indices? You can use Kibana monitoring to see index activity. ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [October 22, 2020, 6:23am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/3 "2020-10-22T06:23:40Z")
@rugenl Yes, but I need to share one source of logs to one user. I don't want give him access to all logs. I have one indices filebeat-\* for all logs from two hosts and that is issue. Could I create index for one source of logs ? I could solve my problem ---
**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Post date:** [October 22, 2020, 7:37am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/4 "2020-10-22T07:37:45Z")
I'm not sure if I understand your question correctly. you have two sources of logs and you want to give access to one source of log to a specific user. for example logs from pc1 for userA and logs from pc2 to userB, am I correct? If that's the case just change the default index name to include `host.name` in it and then create two users and give them specific access to each index. ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [October 22, 2020, 7:47am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/5 "2020-10-22T07:47:21Z")
Yes u understood very well. Ok, but when I create new index for example filebeat\* and I type something more e.x filebeat\*:host.name: pc1 . How create index with specific host ? ---
**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Post date:** [October 22, 2020, 8:54am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/6 "2020-10-22T08:54:50Z")
> [@Charakterny](#): > > How create index with specific host ? According to [docs](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es): > You can set the index dynamically by using a format string to access any event field. For example, this configuration uses a custom field, fields.log\_type, to set the index: > `output.elasticsearch:` > ` hosts: ["http://localhost:9200"]` > ` index: "%{[fields.log_type]}-%{[agent.version]}-%{+yyyy.MM.dd}"` you also need to configure the `setup.template.name` and `setup.template.pattern` options (see [_Elasticsearch index template_](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-template.html)). And don't forget: **Custom `index` settings are ignored when ILM is enabled.** ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [October 23, 2020, 3:18am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/7 "2020-10-23T03:18:26Z")
Here is my filebeat config to push elastic server logs to a different index, changed lines only. ``` setup.ilm.rollover_alias: "filebeat-%{[agent.version]}-elastic-internal" ....output section index: "filebeat-%{[agent.version]}-elastic-internal-%{+yyyy.MM.dd}" ``` This works with ILM. ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [October 23, 2020, 7:14am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/8 "2020-10-23T07:14:13Z")
So turnoff ILM or not ? I added what @rugenl wrote but nothing change. output.elasticsearch hosts: ["xxxxx"] username: "xxx" password: "xxx" index: "filebeat-%{[host.name]}-elastic-internal-%{+yyyy.MM.dd}" setup.ilm.rollover\_alias: "filebeat-%{[host.name]}-elastic-internal" ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [October 23, 2020, 2:06pm UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/9 "2020-10-23T14:06:32Z")
ILM default actions vary with elasticsearch 7 and prior versions. It may be the location of these lines, the setup.ilm..... doesn't go in the output section, find the current line for each. It will work, but there are many different starting points and paths to get there. ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [October 24, 2020, 9:55am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/10 "2020-10-24T09:55:46Z")
Thank you for tips @rugenl and @borna_talebi . I made my custom index 😃 ---
**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Post date:** [October 24, 2020, 9:59am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/11 "2020-10-24T09:59:43Z")
Glad I could help. Can you post your final config here? for future reference. ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [October 24, 2020, 10:19am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/12 "2020-10-24T10:19:21Z")
# ======================= Elasticsearch template setting ======================= setup.template.settings: index.number\_of\_shards: 3 setup.template.name: "ferrari" setup.template.pattern: "ferrari" setup.ilm.enabled: false # ---------------------------- Elasticsearch Output ---------------------------- output.elasticsearch: hosts: ["xxxxxxxxxx:xxxx"] username: "xxxx" password: "xxxxxxxxxx" index: "ferrari-%{+yyyy.MM.dd}" ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 21, 2020, 10:19am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840/13 "2020-11-21T10:19:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.