# Creating an index for each Docker container log using Filebeats
**URL:** https://discuss.elastic.co/t/creating-an-index-for-each-docker-container-log-using-filebeats/162873
**Category:** Beats
**Tags:** filebeat
**Created:** [January 3, 2019, 9:39pm UTC](https://discuss.elastic.co/t/creating-an-index-for-each-docker-container-log-using-filebeats/162873 "2019-01-03T21:39:48Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Joseph\_Gange](https://discuss.elastic.co/u/Joseph_Gange)
#### Post date: [January 3, 2019, 9:39pm UTC](https://discuss.elastic.co/t/creating-an-index-for-each-docker-container-log-using-filebeats/162873/1 "2019-01-03T21:39:48Z")
I'm using Filebeats to capture and send my Docker container logs to Elasticsearch. I am adding the Docker metadata and I would like to name each index with the associated service name. Based on the default template, I was looking at the docker.container.labels.com.docker.swarm.service.name field for my index name. I tried setting this in the filebeat.yml file but although the container started successfully, no indices were created in elasticsearch.
The relevant port of the filebeats.yml file look like this-
```
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
filebeat.modules:
- module: logstash
filebeat.inputs:
- type: docker
combine_partial: true
containers:
path: "/var/lib/docker/containers"
stream: "all"
ids:
- "*"
processors:
- add_docker_metadata: ~
output.elasticsearch:
hosts: ["http://elasticsearch_log:9200"]
index: "%{[docker.container.labels.com.docker.swarm.service.name]}-%{[beat.version]}-%{+yyyy.MM.dd}"
setup.template:
name: "%{[docker.container.labels.com.docker.swarm.service.name]}"
pattern: "%{[docker.container.labels.com.docker.swarm.service.name]}-*"
setup.kibana:
host: ["kibana:5601"]
```
I recognize this will result in a lot indices but I am not concerned with that right now, just seeing if this is a workable configuration.
Please advise.
Thanks.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 3, 2019, 10:23pm UTC](https://discuss.elastic.co/t/creating-an-index-for-each-docker-container-log-using-filebeats/162873/2 "2019-01-03T22:23:07Z")
Having lots of small indices and shards is very inefficient and likely to cause you problems down the line. I would therefore recommend against doing this.
---
### Author:  [@Joseph\_Gange](https://discuss.elastic.co/u/Joseph_Gange)
#### Post date: [January 3, 2019, 10:42pm UTC](https://discuss.elastic.co/t/creating-an-index-for-each-docker-container-log-using-filebeats/162873/3 "2019-01-03T22:42:37Z")
Understood-- this is a requirement for a project. I need to demonstrate this a viable process.
Thanks!
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 4, 2019, 7:17am UTC](https://discuss.elastic.co/t/creating-an-index-for-each-docker-container-log-using-filebeats/162873/4 "2019-01-04T07:17:32Z")
I am doubt this is a viable approach. I would expect you to run into performance and stability problems quite quickly unless you only have a trivial number of containers.
It would be interesting to know why this would be a requirement.
---
### Author:  [@Joseph\_Gange](https://discuss.elastic.co/u/Joseph_Gange)
#### Post date: [January 4, 2019, 2:59pm UTC](https://discuss.elastic.co/t/creating-an-index-for-each-docker-container-log-using-filebeats/162873/5 "2019-01-04T14:59:54Z")
Hi Christian,
It is a trivial number of containers (about 10). And I fully understand the performance implications. Could you let me know how the configuration would work? That way I can at least POC it and then make the recommendations.
Thanks,
Joe
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 1, 2019, 3:10pm UTC](https://discuss.elastic.co/t/creating-an-index-for-each-docker-container-log-using-filebeats/162873/6 "2019-02-01T15:10:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.