# How to create separate index for separate devices?

**URL:** <https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410>\
**Category:** Logstash\
**Created:** [March 17, 2018, 6:19pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410 "2018-03-17T18:19:38Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [March 17, 2018, 6:19pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410/1 "2018-03-17T18:19:38Z")

</div>

Hi there,

I have around 8-10 devices which are sending logs to logstash over syslog. I need to if I can have separate index created per dvice? like logstash-router1-_, logstash-firewall-_, logstash-nginx-\* and so on?

What do I need to do to achieve the same? Rewrite separate templates or mappings? Pls advise.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 17, 2018, 6:45pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410/2 "2018-03-17T18:45:35Z")

</div>

If you have a hostname or a device type in the syslog message then you could make the index name refer to that.

```auto
index => "logstash-%{hostname}-%{+YYYY.MM.dd}"

```

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [March 17, 2018, 6:50pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410/3 "2018-03-17T18:50:36Z")

</div>

Hey,

Thanks and how about mapping then? I guess that would be changed as well?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 19, 2018, 6:34pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410/4 "2018-03-19T18:34:07Z")

</div>

The fields in your indexes will be mapped according to index templates and, as a fallback, Elasticsearch's automapper. Depending on your mapping requirements you may or may not need different templates.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [March 20, 2018, 1:16pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410/5 "2018-03-20T13:16:40Z")

</div>

Well I am still lacking in templates and mappings ☹ and still looking for basic doc which could describe how and why to create templates?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 20, 2018, 5:59pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410/6 "2018-03-20T17:59:49Z")

</div>

And you've read the sections about mappings and index templates in the Elasticsearch documentation?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 20, 2018, 6:50pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410/7 "2018-03-20T18:50:30Z")

</div>

I would start with an index name that starts with logstash- (so it matches the default template) and not worry about templates until you find a problem that requires one.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2018, 6:51pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410/8 "2018-04-17T18:51:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.