# Elasticsearch output - index name pattern **URL:** \ **Category:** Logstash\ **Created:** [December 4, 2015, 11:45pm UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428 "2015-12-04T23:45:47Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![zombie101](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zombie101/32/6573_2.png) [@zombie101](https://discuss.elastic.co/u/zombie101)\ **Post date:** [December 4, 2015, 11:45pm UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/1 "2015-12-04T23:45:47Z")
The elasticsearch output takes a setting for the index name, with a default of 'logstash-YYYY.MM.dd'. Where does the 'YYYY.MM.dd' come from? Are there other options, such as time (e.g. HHmmss), week of year, day of year, locale month name, etc? Thanks, John Ouellette ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 5, 2015, 12:15am UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/2 "2015-12-05T00:15:57Z")
Basically when LS sends the request to create the index it just asks for `now` in UTC. ---
**Author:** ![zombie101](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zombie101/32/6573_2.png) [@zombie101](https://discuss.elastic.co/u/zombie101)\ **Post date:** [December 5, 2015, 12:28am UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/3 "2015-12-05T00:28:59Z")
Ok, but that isn't quite what I was asking for. Let's say I wanted to create an index that is named by the year, week of year, and day of week (ok, stupid example). If I assume that the default 'YYYY.MM.dd' specification comes from the same Joda DateTimeFormat as the logstash date filter plugin, my ugly index name in the elasticsearch output would be: index =\> "logstash-%{+YYYY.ww.ee}" So, is the format specification the Joda DateTimeFormat, or something completely different? Are there other options? With the %{} format, can I access other logstash terms, like the type, or, I don't know, the host name, etc.? Sorry if this isn't clear 🙂 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 5, 2015, 4:30pm UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/4 "2015-12-05T16:30:27Z")
> Basically when LS sends the request to create the index it just asks for now in UTC. Surely it uses the `@timestamp` field? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 5, 2015, 4:38pm UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/5 "2015-12-05T16:38:35Z")
> So, is the format specification the Joda DateTimeFormat, or something completely different? No, it's Joda-Time alright. > Are there other options? With the %{} format, can I access other logstash terms, like the type, or, I don't know, the host name, etc.? Yes, you can access any field. Here's the relevant part of the documentation: [Accessing event data and fields | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 6, 2015, 10:24pm UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/6 "2015-12-06T22:24:42Z")
> Surely it uses the `@timestamp` field? Indeed it does. Filed a PR to clarify this in the documentation: > > > The \`%{+FORMAT}\` form always formats the \`@timestamp\` field but previously that …hasn't been obvious from the documentation. ---
**Author:** ![zombie101](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zombie101/32/6573_2.png) [@zombie101](https://discuss.elastic.co/u/zombie101)\ **Post date:** [December 7, 2015, 4:51pm UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/7 "2015-12-07T16:51:53Z")
Thanks Magnus! ---
**Author:** ![mrkeelan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrkeelan/32/12755_2.png) [@mrkeelan](https://discuss.elastic.co/u/mrkeelan)\ **Post date:** [December 22, 2016, 11:50pm UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/8 "2016-12-22T23:50:11Z")
Is it possible to tell it to use a different date field, other than @timestamp? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 28, 2016, 8:43pm UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/9 "2016-12-28T20:43:36Z")
> Is it possible to tell it to use a different date field, other than @timestamp? No. ---
**Author:** ![mrkeelan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrkeelan/32/12755_2.png) [@mrkeelan](https://discuss.elastic.co/u/mrkeelan)\ **Post date:** [January 11, 2017, 4:34am UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/10 "2017-01-11T04:34:22Z")
Thanks. I came up with a work-around to use this, and drop or rename @timestamp, if anyone else needs it. ``` filter { mutate { add_field => { "[@metadata][indexDate]" => "%{+YYYY.MM.dd}" } rename => { "@timestamp" => "receivedTimestamp" } } } output { elasticsearch { hosts => [ 'elastic01.example.com:9200', 'elastic02.example.com:9200', 'elastic03.example.com:9200' ] index => "logstash-%{[@metadata][indexDate]}" } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/elasticsearch-output-index-name-pattern/36428/11 "2017-07-06T04:29:28Z")