# Forming Index name for Elasticsearch plugin
**URL:** https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398
**Category:** Logstash
**Created:** [December 11, 2020, 10:24am UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398 "2020-12-11T10:24:16Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@s0umen](https://discuss.elastic.co/u/s0umen)
#### Post date: [December 11, 2020, 10:24am UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398/1 "2020-12-11T10:24:16Z")
I am sending Linux system logs using filebeat to logstash.
my "logstash.conf" file is something like below (within double Line). I am trying to name index dynamically using "type" variable. But when I view it in Kibana, I see index name name is not changed as per the value of the "type" substitution variable but instead taking the format as a string.
My idea to see an index with name "log-Test' but instead its creating the index name as
log-%{type}-2020.12.10
```
=====================================================
```
# input { beats { port =\> 5044 type =\> "Test" } } output { elasticsearch { hosts =\> ["[internal-elastic-elk-1817988673.ap-southeast-1.elb.amazonaws.com:9200](http://internal-elastic-elk-1817988673.ap-southeast-1.elb.amazonaws.com:9200)"] index =\> "log-%{type}" } }
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [December 11, 2020, 11:00am UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398/2 "2020-12-11T11:00:07Z")
Hi ! i saw you tried to use syntax but you have to change # to (`)x3 on the forum
Try this
```auto
filter {
mutate{ add_field =>{"[@metadata][target_index]"=> "log-%{type}"}}
}
index => "%{[@metadata][target_index]}"
```
---
### Author:  [@s0umen](https://discuss.elastic.co/u/s0umen)
#### Post date: [December 12, 2020, 12:07pm UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398/3 "2020-12-12T12:07:08Z")
not worked.
the index name became log-%type-2020.12.12.
I have used same code like you only added a tail of date. it seems "type" although ideally as per the [beats plugin documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-host) beats plugin support Common configuration option "type" is supported, it is not actually getting picked up dynamically by [elasticsearch output plugin](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html). this says that " You cannot use dynamic variable substitution when `ilm_enabled` is `true` and when using `ilm_rollover_alias`"
Although it also says ...
"In order to minimize the number of open connections to Elasticsearch, maximize the bulk size and reduce the number of "small" bulk requests (which could easily fill up the queue), it is usually more efficient to have a single Elasticsearch output."...
This is very strange situation, my case, "index" in elasticsearch output plugine dynamically replaces the %{+YYYY.MM.dd} value but rejecting % type...
This is strange... what is the missing link? I am using logstash 7.9.3.
my filter section like below...
'''
filter {
mutate {
add\_field =\> { "[@metadata][target\_index]" =\> "testlog-%type-%{+YYYY.MM.dd}"}
}
}
'''
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 12, 2020, 4:06pm UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398/4 "2020-12-12T16:06:10Z")
> [@s0umen](#):
>
> add\_field =\> { "[@metadata][target\_index]" =\> "testlog-%type-%{+YYYY.MM.dd}"}
sprintf references require the {}. Change %type to %{type}.
---
### Author:  [@s0umen](https://discuss.elastic.co/u/s0umen)
#### Post date: [December 13, 2020, 12:28pm UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398/5 "2020-12-13T12:28:31Z")
I did that too.... but no resolution... actually, after changing the string as
'''
filter {
mutate {
add\_field =\> { "[@metadata][target\_index]" =\> "testlog-%{type}-%{+YYYY.MM.dd}" }
}
}
'''
no new indexes are created for the day 13th Dec.
seems that's a wrong syntax then
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [December 13, 2020, 6:38pm UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398/6 "2020-12-13T18:38:49Z")
Please show full config for further help i cannot understand how it's not working.
---
### Author:  [@s0umen](https://discuss.elastic.co/u/s0umen)
#### Post date: [December 14, 2020, 6:18am UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398/7 "2020-12-14T06:18:20Z")
Ok, lets have the entire thing together...
'''
input {
beats {
port =\> 5044
type =\> "Test"
}
}
filer {
mutate{ add\_field =\>{"[@metadata][target\_index]"=\> "log-%{type}"}}
}
output {
elasticsearch {
hosts =\> ["myeshost:9200"]
index =\> "%{[@metadata][target\_index]}"
}
}
'''
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 11, 2021, 6:18am UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398/8 "2021-01-11T06:18:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.