Determining Elasticsearch index from message

Elastic Stack Logstash
1

Hi.

I am getting the following message from a Kafka input and would like to determine the Elasticsearch index from it:

{ "@timestamp": "2016-08-03T14:58:39.964Z", "@version": "1", "message": "{\"@timestamp\":\"2016-08-03T14:58:20.381Z\",\"beat\":{\"hostname\":\"MyPC\",\"name\":\"MyPC\"},\"input_type\":\"log\",\"message\":\"{\\\"index\\\":\\\"MyIndex\\\"}\",\"offset\":6639,\"source\":\"d:\\\\tst.log\",\"type\":\"log\"}" }

As you can see there's a "index" : "MyIndex" field inside the internal message JSON (it originally came from FileBeat).

How can I use this field to set 'MyIndex" as the Elasticsearch index?

Thanks.

2

You should reconfigure the input creating this message to use codec => json {} because you have a json message. After that, you can use Event Dependent Configuration