# Filebeat: file output with dynamic filename

**URL:** https://discuss.elastic.co/t/filebeat-file-output-with-dynamic-filename/256002
**Category:** Beats
**Tags:** filebeat
**Created:** [November 19, 2020, 2:35pm UTC](https://discuss.elastic.co/t/filebeat-file-output-with-dynamic-filename/256002 "2020-11-19T14:35:05Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![james\_m](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/james_m/32/79324_2.png) [@james\_m](https://discuss.elastic.co/u/james_m)
#### Post date: [November 19, 2020, 2:35pm UTC](https://discuss.elastic.co/t/filebeat-file-output-with-dynamic-filename/256002/1 "2020-11-19T14:35:05Z")

</div>

Hi,

I'm using the file output module to write some container logs to NFS.  
I can't figure out how to make the output filename dynamic - I'd like the filename to be the container name.

I suspect I have two options.

1. Set the "filename" option to be a log data field  
I've tried the usual `${log_data_field}` syntax, can't get this to work, it just uses this option verbatim.

2. The docs say the default filename is the beat name - rewrite the beat name dynamically.

```auto
      - rename:
          fields:
            - from: "container.name"
              to: "@metadata.beat"
          ignore_missing: true
          fail_on_error: true

```

tried the above - beat and output filename stays the same.

Does anyone have any ideas on this?

thanks

James M

---

<div class="post-metadata">

### Author: ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [November 19, 2020, 2:42pm UTC](https://discuss.elastic.co/t/filebeat-file-output-with-dynamic-filename/256002/2 "2020-11-19T14:42:24Z")

</div>

check this [github](https://github.com/elastic/beats/issues/3178)

> [@](#):
>
> The file output doesn't support using [format strings](https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format-type.html#_format_string_sprintf).

---

<div class="post-metadata">

### Author: ![james\_m](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/james_m/32/79324_2.png) [@james\_m](https://discuss.elastic.co/u/james_m)
#### Post date: [November 19, 2020, 2:49pm UTC](https://discuss.elastic.co/t/filebeat-file-output-with-dynamic-filename/256002/3 "2020-11-19T14:49:29Z")

</div>

Thanks for the pointer!

I'll try something else.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2020, 4:49pm UTC](https://discuss.elastic.co/t/filebeat-file-output-with-dynamic-filename/256002/4 "2020-12-17T16:49:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.