# File output with data from field
**URL:** https://discuss.elastic.co/t/file-output-with-data-from-field/241895
**Category:** Logstash
**Created:** [July 20, 2020, 1:20pm UTC](https://discuss.elastic.co/t/file-output-with-data-from-field/241895 "2020-07-20T13:20:52Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@elk2](https://discuss.elastic.co/u/elk2)
#### Post date: [July 20, 2020, 1:20pm UTC](https://discuss.elastic.co/t/file-output-with-data-from-field/241895/1 "2020-07-20T13:20:53Z")
I collect different logs from various sources.
I replaced logstash timestamp with machine logs timestamp to have time based events into elasticsearch and I added a "processed\_at" field with a part of logstash timestamp.
This is my conf:
```
input {
beats {
port => 5044
}
}
filter{
mutate {
add_field => { "processed_at" => "%{+YYYY-MM-dd_HH-mm}" }
remove_field => ["beat","tags"]
}
date{
match => ["sys_created_on", "dd/MM/yyyy HH:mm:ss"]
}
}
output{
file {
path => "/var/log/%{processed_at}-test.log"
}
elasticsearch {
index => "test-%{+YYYY.MM.dd}"
hosts => [localhost:9200]
}
}
```
Now I want to create elasticsearch indexes daily but with "processed\_at" date field and not with replaced timestamp.
Can I use part of "processed\_at" field without hours and minute or I need to create another field.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 20, 2020, 5:11pm UTC](https://discuss.elastic.co/t/file-output-with-data-from-field/241895/2 "2020-07-20T17:11:55Z")
> [@elk2](#):
>
> `index => "test-%{+YYYY.MM.dd}"`
That will always reference @timestamp. If you want to build an index name using a different field you could do it in a ruby filter using strftime.
---
### Author:  [@elk2](https://discuss.elastic.co/u/elk2)
#### Post date: [July 21, 2020, 7:47am UTC](https://discuss.elastic.co/t/file-output-with-data-from-field/241895/3 "2020-07-21T07:47:47Z")
Thanks.
I thinked another field like this:
```
mutate {
add_field => { "processed_time" => "%{+YYYY-MM-dd_HH-mm}" }
add_field => { "processed_data" => "%{+YYYY-MM-dd}" }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 19, 2020, 9:05am UTC](https://discuss.elastic.co/t/file-output-with-data-from-field/241895/5 "2020-08-19T09:05:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.