# Define an index name when the file is already created
**URL:** https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926
**Category:** Elasticsearch
**Created:** [April 13, 2018, 8:06am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926 "2018-04-13T08:06:45Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@pablo\_gracia](https://discuss.elastic.co/u/pablo_gracia)
#### Post date: [April 13, 2018, 8:06am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/1 "2018-04-13T08:06:45Z")
How can i create an index in elasticsearch when a file is already created and it contains logs?
the path is /var/log/tcp.log and i want to call the index "tcp"
> Apr 5 16:11:01 T30\_PABLO (2018-04-05T14:11:01) http-proxy[2072]: msg\_id="1AFF-0021" Allow 1-Trusted 4-Embou tcp 192.168.1.75 [MY PUBLIC IP ADDRES] 43832 80 msg="ProxyAllow: HTTP Request categories" proxy\_act="HTTP-Client.Standard.1" cats="Uncategorized" op="GET" dstname="[pablo.com](http://pablo.com)" arg="/api/v1/third/flushdata" (HTTP-proxy-00)
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 13, 2018, 8:18am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/2 "2018-04-13T08:18:46Z")
I'm not sure about your question.
Is it a filebeat question? And elasticsearch question?
Something else?
What prevents you to use `tcp` as the index name?
---
### Author:  [@pablo\_gracia](https://discuss.elastic.co/u/pablo_gracia)
#### Post date: [April 13, 2018, 8:22am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/3 "2018-04-13T08:22:24Z")
@dadoonet
An elastic one.
And I use "tcp" because later on i will index my udp ones so...
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 13, 2018, 8:41am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/4 "2018-04-13T08:41:28Z")
I don't understand then the relationship with a file named `/var/log/tcp.log`...
To index a document in elasticsearch you basically run:
```auto
POST tcp/_doc
{
"message": "Apr 5 16:11:01 T30_PABLO (2018-04-05T14:11:01) http-proxy[2072]:..."
}
```
---
### Author:  [@pablo\_gracia](https://discuss.elastic.co/u/pablo_gracia)
#### Post date: [April 13, 2018, 8:44am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/5 "2018-04-13T08:44:24Z")
Ok. Thank you.
Helps a lot even if you dont think so. 🙂
---
### Author:  [@pablo\_gracia](https://discuss.elastic.co/u/pablo_gracia)
#### Post date: [April 13, 2018, 8:52am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/6 "2018-04-13T08:52:13Z")
And do you know how I can index depending on the msg\_ids because those msg\_ids means different types of attack. Because maybe it will be better if I index my logs based on their msg\_id I don´t know 😕
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 13, 2018, 9:07am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/7 "2018-04-13T09:07:26Z")
This?
```auto
PUT tcp/_doc/1AFF-0021
{
"message": "Apr 5 16:11:01 T30_PABLO (2018-04-05T14:11:01) http-proxy[2072]:..."
}
```
---
### Author:  [@pablo\_gracia](https://discuss.elastic.co/u/pablo_gracia)
#### Post date: [April 13, 2018, 10:32am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/8 "2018-04-13T10:32:47Z")
@dadoonet
I do not mean that specifically. Because I get an excessive amount of logs, then indexing them by msg\_id would be the best way, but the way you show me I would index a message and not a bunch of them. Because I've passed you the way the logs arrive.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 13, 2018, 10:44am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/9 "2018-04-13T10:44:10Z")
Again, I have no idea of what you are doing.
But have a look at [https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 11, 2018, 10:44am UTC](https://discuss.elastic.co/t/define-an-index-name-when-the-file-is-already-created/127926/10 "2018-05-11T10:44:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.