Create multiple indices grouped by a field


I have a .csv file with 2 million records and I am using logstash to index the .csv file.
I do not want to index all records in one index. So I want them to index them based on say states. So basically I'll have 50 indices.

try-"state name"
try-MD etc.

Can I do this?

Yes, just reference the name of the field containing the state name or abbreviation in the elasticsearch output's index option, e.g.

index => "try-%{state}"


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.