# Create index with the same name as request path value, using ElasticSearch output **URL:** \ **Category:** Logstash\ **Created:** [April 9, 2019, 8:52am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986 "2019-04-09T08:52:19Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Miao](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Miao](https://discuss.elastic.co/u/Miao)\ **Post date:** [April 9, 2019, 8:52am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986/1 "2019-04-09T08:52:19Z")
This is my `logstash.conf`: ``` input { http { host => "127.0.0.1" port => 31311 } } output { elasticsearch { hosts => ["http://localhost:9200"] } stdout { codec => "rubydebug" } } ``` As a test, I ran this command in PowerShell: `C:\Users\Me\Downloads\curl-7.64.1-win64-mingw\bin> .\curl.exe -XPUT 'http://127.0.0.1:31311/twitter'` The following output was displayed inside my `Logstash` terminal: ``` { "@timestamp" => 2019-04-09T08:32:09.250Z, "message" => "", "@version" => "1", "headers" => { "request_path" => "/twitter", "http_version" => "HTTP/1.1", "http_user_agent" => "curl/7.64.1", "request_method" => "PUT", "http_accept" => "*/*", "content_length" => "0", "http_host" => "127.0.0.1:31311" }, "host" => "127.0.0.1" } ``` When I then ran `C:\Users\Me\Downloads\curl-7.64.1-win64-mingw\bin> .\curl.exe -XGET "http://127.0.0.1:9200/_cat/indices"` inside PowerShell, I saw `yellow open logstash-2019.04.09 1THStdPfQySWl1WPNeiwPQ 5 1 0 0 401b 401b` An index named `logstash-2019.04.09` has been created in response to my `PUT` request, following the ElasticSearch [convention](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index). My question is: If I want the index to have the same value as the `{index_name}` parameter I pass inside the the command `.\curl.exe -XPUT 'http://127.0.0.1:31311/{index_name}'`, how should I configure the ElasticSearch output inside my `logstash.conf` file? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 9, 2019, 10:19am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986/2 "2019-04-09T10:19:37Z")
If you take a look at the output, you can see that the `[headers][request_path]` field contains the path. You can use those values to specify the logstash index name, see [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) Note: I also moved this into the logstash category. ---
**Author:** ![Miao](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Miao](https://discuss.elastic.co/u/Miao)\ **Post date:** [April 9, 2019, 10:36am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986/3 "2019-04-09T10:36:35Z")
Thank you for your reply. Here is my updated `logstash.conf` file: ``` input { http { host => "127.0.0.1" port => 31311 } } filter { mutate { split => ["%{headers.request_path}", "/"] add_field => { "index_id" => "%{headers.request_path[0]}" } add_field => { "document_id" => "%{headers.request_path[1]}" } } } output { elasticsearch { hosts => "http://localhost:9200" index => "%{index_id}" document_id => "%{document_id}" } stdout { codec => "rubydebug" } } ``` However, when I submit a `PUT`request, Logstash crashes with this error message: > Invalid FieldReference: `headers.request_path[0]` How can I fix this? ---
**Author:** ![Miao](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Miao](https://discuss.elastic.co/u/Miao)\ **Post date:** [April 9, 2019, 10:43am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986/4 "2019-04-09T10:43:15Z")
The same error occurs when I change the `filter` segment to the following: ``` filter { mutate { split => ["%{[headers][request_path]}", "/"] add_field => { "index_id" => "%{[headers][request_path][0]}" } add_field => { "document_id" => "%{[headers][request_path][1]}" } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 9, 2019, 11:12am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986/5 "2019-04-09T11:12:29Z")
> [@Miao](#): > > mutate { split =\> ["%{[headers][request\_path]}", "/"] That should be ``` split => { "[headers][request_path]" => "/"} ``` index\_id will get set to "", since nothing precedes the first / in /twitter. ---
**Author:** ![Miao](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Miao](https://discuss.elastic.co/u/Miao)\ **Post date:** [April 9, 2019, 11:21am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986/6 "2019-04-09T11:21:58Z")
Thank you for your reply. This is my updated `logstash.conf`file: ``` input { http { host => "127.0.0.1" port => 31311 } } filter { mutate { split => { "[headers][request_path]" => "/"} add_field => { "index_id" => "%{headers.request_path[1]}" } } } output { elasticsearch { hosts => "http://localhost:9200" index => "%{index_id}" } stdout { codec => "rubydebug" } } ``` However, I still see an `Invalid FieldReference` error message: > Invalid FieldReference: `headers.request_path[1]` ---
**Author:** ![Miao](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Miao](https://discuss.elastic.co/u/Miao)\ **Post date:** [April 9, 2019, 11:25am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986/7 "2019-04-09T11:25:01Z")
Hello Badger, never mind, I noticed that I made an error. After changing `add_field => { "index_id" => "%{headers.request_path[1]}" }` to `add_field => { "index_id" => "%{[headers][request_path][1]}" }`, things are working now. Thank you! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 7, 2019, 11:25am UTC](https://discuss.elastic.co/t/create-index-with-the-same-name-as-request-path-value-using-elasticsearch-output/175986/8 "2019-05-07T11:25:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.