# Dynamic index names
**URL:** https://discuss.elastic.co/t/dynamic-index-names/281816
**Category:** Logstash
**Created:** [August 18, 2021, 12:02pm UTC](https://discuss.elastic.co/t/dynamic-index-names/281816 "2021-08-18T12:02:41Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@rudo1](https://discuss.elastic.co/u/rudo1)
#### Post date: [August 18, 2021, 12:02pm UTC](https://discuss.elastic.co/t/dynamic-index-names/281816/1 "2021-08-18T12:02:41Z")
Hi.
I'm facing a problem with creating dynamic index names. I have few if statemnts like shown below to add new fields, but I can't see anything in kibana when I try to name index dynamically based on its value.
```auto
filter {
if [host] =~ /pattern/ {
mutate {
add_field => {"site_code" => "code1"}
add_field => {"region" => "region1"}
}
}
else {
mutate {
add_field => {"site_code" => "code2"}
add_field => {"region" => "region2"}
}
}
Some parsing here...
}
output {
elasticsearch {
hosts => "http://address:9200"
index => "syslog-%{[site_code]}-%{+YYY.MM.dd}"
user => "name"
password => "pass"
}
}
```
I tried a different example where I'm using [host] field instead of [site\_code] that I created and it works.
```auto
output {
elasticsearch {
hosts => "http://address:9200"
index => "syslog-%{[host]}-%{+YYY.MM.dd}"
user => "name"
password => "pass"
}
}
```
Is there any difference between [host] field and the [site\_code] field that I created? Can I use it somehow to create dynamic indexes or am I doing something wrong?
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [August 18, 2021, 12:12pm UTC](https://discuss.elastic.co/t/dynamic-index-names/281816/2 "2021-08-18T12:12:49Z")
Does logstash report any errors? Does the index show up at all in the index management page?
---
### Author:  [@rudo1](https://discuss.elastic.co/u/rudo1)
#### Post date: [August 18, 2021, 12:33pm UTC](https://discuss.elastic.co/t/dynamic-index-names/281816/3 "2021-08-18T12:33:17Z")
When using [site\_code] field in index name i got this error: "Could not index event to Elasticsearch." and can't see it in index management. When using [host] field i can't see any error and index normally shows up in index management page.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [August 18, 2021, 12:52pm UTC](https://discuss.elastic.co/t/dynamic-index-names/281816/4 "2021-08-18T12:52:04Z")
Can you share the entire logstash line of the error when trying to use `site_code`? This line will say the reason why it can't index.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 18, 2021, 1:50pm UTC](https://discuss.elastic.co/t/dynamic-index-names/281816/5 "2021-08-18T13:50:34Z")
> [@rudo1](#):
>
> I'm facing a problem with creating dynamic index names.
In recent versions that have [ILM](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm) enabled the index option on the elasticsearch output is ignored.
---
### Author:  [@rudo1](https://discuss.elastic.co/u/rudo1)
#### Post date: [August 19, 2021, 4:32am UTC](https://discuss.elastic.co/t/dynamic-index-names/281816/6 "2021-08-19T04:32:20Z")
Thank you all for your replies. I didn't know that I can't use uppercase in index name (found it in another error message). Everything works fine.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 16, 2021, 4:32am UTC](https://discuss.elastic.co/t/dynamic-index-names/281816/7 "2021-09-16T04:32:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.