### Author:  [@lcanas](https://discuss.elastic.co/u/lcanas)
#### Post date: [January 29, 2017, 10:55am UTC](https://discuss.elastic.co/t/doubts-about-creating-indexes-based-on-log-timestamps/73120/1 "2017-01-29T10:55:23Z")
Hi guys!
during the last days I've been reading documentation in order to get my apache logs imported in different indexes based on the date of the log entries. With the configuration below I got it running with indexes like "index\_period\_2016dec". Now I would like to go further and get the number of the month instead of the name, so it is easier to sort the different indexes.
My two questions are:
- is "correct" the way I did it with the whole regexp for grok? are there any other ways to do this in a simpler way?
- how do I got the month (string) translated to its number?
```auto
filter {
if [type] == "apache-access" {
grok {
match => ["message", '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[(?%{MONTHDAY}/%{MONTH:auxmonth}/%{YEAR:auxyear}:%{TIME} %{INT})\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent}']
}
date {
locale => "en"
match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
}
mutate {
lowercase => ["auxmonth"]
}
}
}
output {
if [request] =~ /(\.ova)|(\.qc2)|(\.rpm)|(\.gz)|(\.bz2)|(\.deb)$/ {
if [response] =~ /^2\d\d/ {
elasticsearch {
hosts => ["elasticsearch:443"]
ssl => true
ssl_certificate_verification => false
path => "data"
user => "myuser"
password => " ****"
index => "index_period_%{auxyear}%{auxmonth}"
manage_template => false
workers => 5
document_type => "items"
}
}
}
}
```
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 29, 2017, 11:19am UTC](https://discuss.elastic.co/t/doubts-about-creating-indexes-based-on-log-timestamps/73120/2 "2017-01-29T11:19:36Z")
The usual way to create time-based indices from Logstash is to base the index name on the @timestamp field. An example of how to do this is the default index pattern for the [index parameter](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index). If you changed your index parameter to `index => "index_period_%{+YYYY.MM}"` you would get a monthly index with numeric month.
---
### Author:  [@lcanas](https://discuss.elastic.co/u/lcanas)
#### Post date: [January 29, 2017, 5:37pm UTC](https://discuss.elastic.co/t/doubts-about-creating-indexes-based-on-log-timestamps/73120/3 "2017-01-29T17:37:39Z")
Thanks for your reply Christian :). As far as I know by doing that you get a numeric month based on the current time. So this is not what I'm looking for.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 29, 2017, 5:49pm UTC](https://discuss.elastic.co/t/doubts-about-creating-indexes-based-on-log-timestamps/73120/4 "2017-01-29T17:49:32Z")
It will give you numeric month based on the @timestamp field, which gets populated by your date filter based on the value in the 'timestamp' field.
---
### Author:  [@lcanas](https://discuss.elastic.co/u/lcanas)
#### Post date: [January 30, 2017, 4:21pm UTC](https://discuss.elastic.co/t/doubts-about-creating-indexes-based-on-log-timestamps/73120/5 "2017-01-30T16:21:03Z")
> [@Christian\_Dahlqvist](#):
>
> %{+YYYY.MM}
You are right. I did some tests a days ago and I thought it did not work but it does!!
Thanks for the support 👍
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 27, 2017, 4:21pm UTC](https://discuss.elastic.co/t/doubts-about-creating-indexes-based-on-log-timestamps/73120/6 "2017-02-27T16:21:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.