# Custom name index kibana

**URL:** https://discuss.elastic.co/t/custom-name-index-kibana/202262
**Category:** Logstash
**Created:** [October 4, 2019, 1:48am UTC](https://discuss.elastic.co/t/custom-name-index-kibana/202262 "2019-10-04T01:48:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![TheSun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thesun/32/44614_2.png) [@TheSun](https://discuss.elastic.co/u/TheSun)
#### Post date: [October 4, 2019, 1:48am UTC](https://discuss.elastic.co/t/custom-name-index-kibana/202262/1 "2019-10-04T01:48:53Z")

</div>

Hi,  
I am handling pfsense data with ELK stack.  
But I have 2 pfsense. How to put data of each pfsense into a different index?  
I tried with logstash output but it didn't work.  
This is my configuration.  
Please!! help me!!

```
input {
  tcp {
type => "syslog2"
port => 5140
  }
}
input {
  udp {
type => "syslog2"
port => 5140
  }
}

    filter {  
      if [type] == "syslog2" {
    #change to pfSense ip address
    if [host] =~ /10\.10\.2\.2/ {
      mutate {
        add_tag => ["PFSense", "Ready"]
      }
    }
    if "Ready" not in [tags] {
      mutate {
        add_tag => ["syslog2"]
      }
    }
      }
    }
    filter {  
      if [type] == "syslog2" {
    mutate {
      remove_tag => "Ready"
    }
      }
    }

    filter {  
      if "syslog2" in [tags] {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
      locale => "en"
    }
    if !("_grokparsefailure" in [tags]) {
      mutate {
        replace => ["@source_host", "%{syslog_hostname}"]
        replace => ["@message", "%{syslog_message}"]
      }
    }
    mutate {
      remove_field => ["syslog_hostname", "syslog_message", "syslog_timestamp"]
    }
    # if "_grokparsefailure" in [tags] {
    # drop { }
    # }
      }
    }

    filter {  
      if "PFSense" in [tags] {
    grok {
      add_tag => ["firewall"]
      match => ["message", "<(?<evtid>.*)>(?<datetime>(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) (?<prog>.*?): (?<msg>.*)" ]
    }
    mutate {
      gsub => ["datetime"," "," "]
    }
    date {
      match => ["datetime", "MMM dd HH:mm:ss"]
      timezone => "Asia/Ho_Chi_Minh"
    }
    mutate {
      replace => ["message", "%{msg}"]
    }
    mutate {
      remove_field => ["msg", "datetime"]
    }
    }
    if [prog] =~ /^filterlog$/ {  
    mutate {
      remove_field => ["msg", "datetime"]
    }
    grok {
      patterns_dir => "/etc/logstash/conf.d/patterns"
      match => [ "message", "%{PFSENSE_LOG_DATA}%{PFSENSE_IP_SPECIFIC_DATA}%{PFSENSE_IP_DATA}%{PFSENSE_PROTOCOL_DATA}",
                 "message", "%{PFSENSE_LOG_DATA}%{PFSENSE_IPv4_SPECIFIC_DATA_ECN}%{PFSENSE_IP_DATA}%{PFSENSE_PROTOCOL_DATA}",
                 "message", "%{PFSENSE_LOG_DATA}%{PFSENSE_IPv6_SPECIFIC_DATA}"]
    }
    mutate {
      lowercase => ['proto']
    }
    geoip {
      add_tag => ["GeoIP"]
      source => "src_ip"
      # Optional GeoIP database
      # Comment out the below if you do not wise to utilize and omit last three steps dealing with (recommended) suffix
      database => "/etc/logstash/GeoLite2-City.mmdb"
    }
      }
    }

    output { stdout { codec => rubydebug }
    	if [type] == "syslog2" {
          elasticsearch {
          hosts => ["http://10.10.1.166:9200"]
          index => "Pfsense1-%{+YYYY.MM.dd}"
       }
    }
    	else {
    	  elasticsearch {
    	  hosts => ["http://10.10.1.166:9200"]
          index => "Pfsense2-%{+YYYY.MM.dd}"
    	}
     }
    }
```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 4, 2019, 6:31pm UTC](https://discuss.elastic.co/t/custom-name-index-kibana/202262/2 "2019-10-04T18:31:38Z")

</div>

Your output is conditional on the value of [type], but every event is assigned the same [type] by the input. Did you mean to make it conditional on [tags]?

---

<div class="post-metadata">

### Author: ![TheSun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thesun/32/44614_2.png) [@TheSun](https://discuss.elastic.co/u/TheSun)
#### Post date: [October 5, 2019, 2:42am UTC](https://discuss.elastic.co/t/custom-name-index-kibana/202262/3 "2019-10-05T02:42:41Z")

</div>

Sorry!! I want to somehow have my index created so that I can distinguish between index PFsens1 and index PFsense2.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 2, 2019, 2:42am UTC](https://discuss.elastic.co/t/custom-name-index-kibana/202262/4 "2019-11-02T02:42:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.