# Elasticsearch input plugin index date

**URL:** https://discuss.elastic.co/t/elasticsearch-input-plugin-index-date/145786
**Category:** Logstash
**Created:** [August 23, 2018, 6:54pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-index-date/145786 "2018-08-23T18:54:10Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Scoyle](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@Scoyle](https://discuss.elastic.co/u/Scoyle)
#### Post date: [August 23, 2018, 6:54pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-index-date/145786/1 "2018-08-23T18:54:11Z")

</div>

Hello,

im trying to get the elasticsearch input plugin to look at the previous days index. it seems to only like the wildcard or a full index name in the field. has anyone been able to change the date on the index for the plugin?

index =\> "indexname-%{+YYY.MM.dd}" gives an error of no such index except thats how the indexes are formatted index =\> "indexname-2018.08.23" will give me todays index and work but i constantly want it to be using the previous days because im inputting certain information into a csv file.

thanks!

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 23, 2018, 8:12pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-index-date/145786/2 "2018-08-23T20:12:26Z")

</div>

There's no great way of doing this. Why not use a wildcard index name and use a query to restrict which documents are returned by the elasticsearch input?

---

<div class="post-metadata">

### Author: ![Scoyle](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@Scoyle](https://discuss.elastic.co/u/Scoyle)
#### Post date: [August 24, 2018, 11:56am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-index-date/145786/3 "2018-08-24T11:56:15Z")

</div>

I was thinking that might be the case. would you just query indexname-{now/d-1d{YYY.MM.dd}}?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 24, 2018, 2:14pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-index-date/145786/4 "2018-08-24T14:14:57Z")

</div>

No, use the elasticsearch input's `query` option.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 21, 2018, 2:14pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-index-date/145786/5 "2018-09-21T14:14:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
