# Get substring of a field and use it in index name
**URL:** https://discuss.elastic.co/t/get-substring-of-a-field-and-use-it-in-index-name/77999
**Category:** Logstash
**Created:** [March 9, 2017, 2:44pm UTC](https://discuss.elastic.co/t/get-substring-of-a-field-and-use-it-in-index-name/77999 "2017-03-09T14:44:49Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ldms020255](https://discuss.elastic.co/u/ldms020255)
#### Post date: [March 9, 2017, 2:44pm UTC](https://discuss.elastic.co/t/get-substring-of-a-field-and-use-it-in-index-name/77999/1 "2017-03-09T14:44:49Z")
Here's my config
input {
redis {
data\_type =\> "list"
key =\> "filebeat"
host =\> "127.0.0.1"
port =\> 6379
threads =\> 5
type =\> "log"
}
}
filter {
grok {
patterns\_dir =\> ["/etc/logstash/conf.d/patterns"]
match =\> ["message" , "%{NGINXACCESS}"]
}
date {
match =\> ["time\_local", "dd/MMM/yyyy:HH:mm:ss Z"]
timezone =\> "Asia/Shanghai"
}
}
output {
elasticsearch {
hosts =\> ["127.0.0.1:9200"]
index =\> "nginx-%{type}-%{+YYYY.MM.dd}"
flush\_size =\> 1000
idle\_flush\_time =\> 2
sniffing =\> false
template\_overwrite =\> true
}
}
So i assign custom date to @timestamp value. My logs are all in this Asia timezone. But the date part %{+YYYY.MM.dd} in index name is utc, which is by design i think. It actually breaks my one day log into two indices. I did search for a workaround but with no luck.
What I'm thinking is i have a "time\_local" field, whose value should be something like 09/Mar/2017:00:00:03 +0800. If I can get a substring of it, 09/Mar/2017, and append to the elasticsearch index name, it would do the trick for me. Is it possible?
Thanks in advance.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 9, 2017, 2:48pm UTC](https://discuss.elastic.co/t/get-substring-of-a-field-and-use-it-in-index-name/77999/2 "2017-03-09T14:48:49Z")
Yes, use grok to capture the parts you want from `time_local` into a field, then reference that field in your output configuration (instead of `%{+YYYY.MM.dd}`). Not sure if slashes are allowed in index names, though.
> It actually breaks my one day log into two indices.
Yes. So?
---
### Author:  [@ldms020255](https://discuss.elastic.co/u/ldms020255)
#### Post date: [March 10, 2017, 12:29am UTC](https://discuss.elastic.co/t/get-substring-of-a-field-and-use-it-in-index-name/77999/3 "2017-03-10T00:29:33Z")
Thanks for the response.
So say logs Mar 08 corrupted or partially done, i want to clean up and start from fresh, normally i wound delete the index of March 08 but with the data split into different indices i can't easily make this happen.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 7, 2017, 12:29am UTC](https://discuss.elastic.co/t/get-substring-of-a-field-and-use-it-in-index-name/77999/4 "2017-04-07T00:29:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.