# Dynamic Index in ElasticSearch

**URL:** https://discuss.elastic.co/t/dynamic-index-in-elasticsearch/53267
**Category:** Logstash
**Created:** [June 20, 2016, 5:41am UTC](https://discuss.elastic.co/t/dynamic-index-in-elasticsearch/53267 "2016-06-20T05:41:46Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![supercoder](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@supercoder](https://discuss.elastic.co/u/supercoder)
#### Post date: [June 20, 2016, 5:41am UTC](https://discuss.elastic.co/t/dynamic-index-in-elasticsearch/53267/1 "2016-06-20T05:41:46Z")

</div>

I have following configuration in logstash whereby I am able to create dynamic "document\_type" into ES based on input JSON received:

```
    elasticsearch {
    			hosts => ["localhost:9200"]
    			index => "queuelogs"
    			document_type => "%{action}"
    		}

```

Here, "action" is the parameter that I receive in JSON and different document\_type gets created as per different action received.

Now I want this to be done same for Index creation, such as following:

```
elasticsearch {
			hosts => ["localhost:9200"]
			index => "%{logtype}"
			document_type => "%{action}"
		}

```

Here, "logtype" is the parameter that I receive in JSON.

**But somehow in ES, it creates index as "%{logtype}" only, not as per actual logtype value .**

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 20, 2016, 5:53am UTC](https://discuss.elastic.co/t/dynamic-index-in-elasticsearch/53267/2 "2016-06-20T05:53:44Z")

</div>

Are you sure `%{logtype}` is being created/populated?

---

<div class="post-metadata">

### Author: ![supercoder](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@supercoder](https://discuss.elastic.co/u/supercoder)
#### Post date: [June 20, 2016, 6:29am UTC](https://discuss.elastic.co/t/dynamic-index-in-elasticsearch/53267/3 "2016-06-20T06:29:45Z")

</div>

The input JSON is as following:

```
{
  "action": "UPLOAD",
  "user": "123",
  "timestamp": "2016 Jun 14 12:00:12",
  "data": {
    "file_id": "2345",
    "file_name": "xyz.pdf"
  },
  "header": {
    "proj_id": "P123",
    "logtype": "httplogs"
  },
  "comments": "Check comments"
}

```

Here, I tried to generate index in following ways:

1. index =\> "%{logtype}"
2. index =\> "%{header.logtype}"

But in both the cases, Logstash does not replace the actual value of logtype from JSON.

---

<div class="post-metadata">

### Author: ![supercoder](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@supercoder](https://discuss.elastic.co/u/supercoder)
#### Post date: [June 21, 2016, 4:18am UTC](https://discuss.elastic.co/t/dynamic-index-in-elasticsearch/53267/4 "2016-06-21T04:18:59Z")

</div>

I was able to solve the problem using following approach:

```
elasticsearch {
			hosts => ["localhost:9200"]
			index => "%{[header][logtype]}"
			document_type => "%{action}"
		}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/dynamic-index-in-elasticsearch/53267/5 "2017-07-06T04:51:42Z")

</div>