# Elasticsearch index **URL:** \ **Category:** Elasticsearch\ **Created:** [February 5, 2014, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-index/15613 "2014-02-05T09:55:00Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sanjeebkdeka](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@sanjeebkdeka](https://discuss.elastic.co/u/sanjeebkdeka)\ **Post date:** [February 5, 2014, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-index/15613/1 "2014-02-05T09:55:00Z")
Is it possible to create index on the content of a message? If so how? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d633b0b6-661f-4344-a9de-c5044e5c7b59%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d633b0b6-661f-4344-a9de-c5044e5c7b59%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 5, 2014, 10:01am UTC](https://discuss.elastic.co/t/elasticsearch-index/15613/2 "2014-02-05T10:01:40Z")
Could you clarify what you are looking for? What is a `message`? -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr Le 5 février 2014 at 10:55:03, [sanjeebkdeka@gmail.com](mailto:sanjeebkdeka@gmail.com) ([sanjeebkdeka@gmail.com](mailto:sanjeebkdeka@gmail.com)) a écrit: ## Is it possible to create index on the content of a message? If so how? You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d633b0b6-661f-4344-a9de-c5044e5c7b59%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d633b0b6-661f-4344-a9de-c5044e5c7b59%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/etPan.52f20c04.836c40e.d955%40MacBook-Air-de-David.local](https://groups.google.com/d/msgid/elasticsearch/etPan.52f20c04.836c40e.d955%40MacBook-Air-de-David.local). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![sanjeebkdeka](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@sanjeebkdeka](https://discuss.elastic.co/u/sanjeebkdeka)\ **Post date:** [February 5, 2014, 10:36am UTC](https://discuss.elastic.co/t/elasticsearch-index/15613/3 "2014-02-05T10:36:50Z")
Example complete log is: \<10\> Jan 17, 2014 TestHost This test message is from src=IP1 to dest=IP2. The message part here is : This test message from src=IP1 to dest=IP2 The requirement is to index based on the meta( such as src and dest ) in the message. On Wednesday, February 5, 2014 3:25:00 PM UTC+5:30, [sanjee...@gmail.com](mailto:sanjee...@gmail.com) wrote: > Is it possible to create index on the content of a message? > If so how? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e1d4d159-ec5d-405d-b598-cfb7b0190823%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e1d4d159-ec5d-405d-b598-cfb7b0190823%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 5, 2014, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-index/15613/4 "2014-02-05T10:47:03Z")
Not sure I fully understand but I guess you should look at logstash: [http://www.elasticsearch.org/overview/logstash/](http://www.elasticsearch.org/overview/logstash/) I think that with logstash you could extract from your line content you need, build a JSON and push it to elasticsearch. -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr Le 5 février 2014 at 11:36:55, [sanjeebkdeka@gmail.com](mailto:sanjeebkdeka@gmail.com) ([sanjeebkdeka@gmail.com](mailto:sanjeebkdeka@gmail.com)) a écrit: Example complete log is: \<10\> Jan 17, 2014 TestHost This test message is from src=IP1 to dest=IP2. The message part here is : This test message from src=IP1 to dest=IP2 The requirement is to index based on the meta( such as src and dest ) in the message. ## On Wednesday, February 5, 2014 3:25:00 PM UTC+5:30, [sanjee...@gmail.com](mailto:sanjee...@gmail.com) wrote: Is it possible to create index on the content of a message? If so how? You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e1d4d159-ec5d-405d-b598-cfb7b0190823%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e1d4d159-ec5d-405d-b598-cfb7b0190823%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/etPan.52f216a7.6ceaf087.d955%40MacBook-Air-de-David.local](https://groups.google.com/d/msgid/elasticsearch/etPan.52f216a7.6ceaf087.d955%40MacBook-Air-de-David.local). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 5, 2014, 11:04am UTC](https://discuss.elastic.co/t/elasticsearch-index/15613/5 "2014-02-05T11:04:13Z")
Yep, this is spot on. Logstash + ES will do this. Regards, Mark Walkom Infrastructure Engineer Campaign Monitor email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com) web: [www.campaignmonitor.com](http://www.campaignmonitor.com) On 5 February 2014 21:47, David Pilato [david@pilato.fr](mailto:david@pilato.fr) wrote: > Not sure I fully understand but I guess you should look at logstash: > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/overview/logstash/) > > I think that with logstash you could extract from your line content you > need, build a JSON and push it to elasticsearch. > > -- > _David Pilato_ | _Technical Advocate_ | _[Elasticsearch.com](http://Elasticsearch.com)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr[https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > > Le 5 février 2014 at 11:36:55, [sanjeebkdeka@gmail.com](mailto:sanjeebkdeka@gmail.com) ( > [sanjeebkdeka@gmail.com](mailto:sanjeebkdeka@gmail.com)) a écrit: > > Example complete log is: \<10\> Jan 17, 2014 TestHost This test message is > from src=IP1 to dest=IP2. > > The message part here is : This test message from src=IP1 to dest=IP2 > > The requirement is to index based on the meta( such as src and dest ) in > the message. > > On Wednesday, February 5, 2014 3:25:00 PM UTC+5:30, sanjee...@gmail.comwrote: > > > Is it possible to create index on the content of a message? > > If so how? > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/e1d4d159-ec5d-405d-b598-cfb7b0190823%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e1d4d159-ec5d-405d-b598-cfb7b0190823%40googlegroups.com) > . > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/etPan.52f216a7.6ceaf087.d955%40MacBook-Air-de-David.local](https://groups.google.com/d/msgid/elasticsearch/etPan.52f216a7.6ceaf087.d955%40MacBook-Air-de-David.local) > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEM624bDiLVSbic2-jhERQKGAMt1xBS2zE%3D-5KAvajOqY6vRXQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624bDiLVSbic2-jhERQKGAMt1xBS2zE%3D-5KAvajOqY6vRXQ%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:52am UTC](https://discuss.elastic.co/t/elasticsearch-index/15613/6 "2017-07-06T01:52:27Z")