# Creating index depends on source

**URL:** <https://discuss.elastic.co/t/creating-index-depends-on-source/167061>\
**Category:** Logstash\
**Created:** [February 5, 2019, 7:15am UTC](https://discuss.elastic.co/t/creating-index-depends-on-source/167061 "2019-02-05T07:15:09Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [February 5, 2019, 8:35am UTC](https://discuss.elastic.co/t/creating-index-depends-on-source/167061/2 "2019-02-05T08:35:10Z")

</div>

Hi @Kanthasamyraja,  
To achieve this I have done the following.

In Filebeat I set some fields like

```
- type: log
  paths:
    - /var/log/sensu/*.log
  encoding: plain
  fields:
    log_prefix: dc
    log_idx: sensu-logs
  fields_under_root: false

```

In Logstash I create @metadata fields based on these.

```
# Adding @metadata needed for index sharding to Filebeat logs
mutate {
  copy => {
   "[fields][log_prefix]" => "[@metadata][log_prefix]"
   "[fields][log_idx]" => "[@metadata][index]"
  }
}

```

And my Elasticsearch output if Logstash can then be just

```
  elasticsearch {
        hosts => ["10.1.1.1:9200", "10.1.1.2:9200", "10.1.1.3:9200"]
        index => "%{[@metadata][log_prefix]}-%{[@metadata][index]}-%{+YYYY.MM.dd}"
  }

```

You can drop one of the @metadata fields if you just need the one "switch".

Hope that helps,  
AB

---

_[View the full topic](https://discuss.elastic.co/t/creating-index-depends-on-source/167061)._