How to append source system data into INDEX name Dynamically during push data from Logstash to ElasticSearch

Elastic Stack Logstash
1

output {
elasticsearch {
hosts =>"http://localhost:9200"
index => "control_tower_poc_-%{+YYYY.MM.dd}"
user => "elastic"
password => "******"

    }
    stdout {
            codec => rubydebug
    }

}

How to add some field or data from the source system, to create the index name based on the customer dynamically

For Example:
"control_tower_poc_{customer_name}-%{+YYYY.MM.dd}"

2

That would be "control_tower_poc_%{customer_name}-%{+YYYY.MM.dd}"

Make sure the field exists (use a filter to add a default value if it does not) or this will create an invalid index name.

1 Like