Create Index Name in Logstash based on event fields

Elastic Stack Logstash
1

Hello,

i try to create an index name based on fields I added in my beat.yml.
I added a customer field in my beats.yml:

processors:
- add_fields:
target: customer
fields:
name: testcustomer

Now I would like to create the index name based on the customer field in logstash:

index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
How can I add the field to the index name, I tried it with
%{customer.name} and %{[customer][name]},
but it wasnt working at all.

It would help me a lot if someone could help me out here :slight_smile:

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.