Create index from the the grok pattern output

Elastic Stack Logstash
1

Hi

I have a requirement of creating the index based on the filed in the message

for example my grok is as below

(?:%{WORD:method}|-)(?:%{NOTSPACE:Appname}|-)

so in my message i have a set of Appname's, so i need to index the data into ES as per the Appname , so is there any way i can do this

Thanks

2

Yes, you can use a "sprintf" reference to the application name.

output {
    elasticsearch {
        index => "%{Appname}"
        ...
    }
}

Just be aware that having a large number of small indexes adds a lot of performance overhead. But if you only have a small number of values for Appname this should be OK.

3

Thank you @Badger for this

Can i know why uppercase letters are not allowed for creating index??

4

That would be an elasticsearch question, not a logstash question.

5

so now i need to add a condition here that if its a specific Appname that has uppercase in it, it has to be indexed as default logstash-* and if its a lower case then it has to be the index as index => "%{Appname}"

any option for this ?

6

I just mutated every thing with lowercase to avoid index failure :slight_smile:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.