# Creating index in Elastic search

**URL:** https://discuss.elastic.co/t/creating-index-in-elastic-search/15552
**Category:** Elasticsearch
**Created:** [February 3, 2014, 5:58am UTC](https://discuss.elastic.co/t/creating-index-in-elastic-search/15552 "2014-02-03T05:58:55Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![san](https://avatars.discourse-cdn.com/v4/letter/s/ba9def/32.png) [@san](https://discuss.elastic.co/u/san)
#### Post date: [February 3, 2014, 5:58am UTC](https://discuss.elastic.co/t/creating-index-in-elastic-search/15552/1 "2014-02-03T05:58:55Z")

</div>

I am an infant as far as Logstash+Elasticsearch is concerned. Could someone  
help me out on the following:

I need to create INDEX based on the content of ACTUAL MESSAGE part of a  
message forwarded to elasticsearch by Logstash.

For example:

\<6\> Jan 9 07:19:26 w2k8r233110 CEF:0|Trend Micro|Deep Security  
Manager|8.0.1310|173|Anti-Malware Quarantined File List  
Exported|3|src=10.100.33.110 suser=System target=10.100.33.111  
msg=Installation/Upgrade of Anti-Malware Component on Agent  
Succeeded.\n\nPrevious Version: \nCurrent Version: {1}\n

In this message, the actual message part is :

CEF:0|Trend Micro|Deep Security Manager|8.0.1310|173|Anti-Malware  
Quarantined File List Exported|3|src=10.100.33.110 suser=System  
target=10.100.33.111 msg=Installation/Upgrade of Anti-Malware Component on  
Agent Succeeded.\n\nPrevious Version: \nCurrent Version: {1}

I need to create index based on 10.100.33.110 so that all messages with  
this source comes in one document.

Thank you in advance.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d5a0f57a-b66d-4899-a720-7d0e486e1488%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d5a0f57a-b66d-4899-a720-7d0e486e1488%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:53am UTC](https://discuss.elastic.co/t/creating-index-in-elastic-search/15552/2 "2017-07-06T01:53:20Z")

</div>