# How to get the sum in time of values in Lens

**URL:** <https://discuss.elastic.co/t/how-to-get-the-sum-in-time-of-values-in-lens/310735>\
**Category:** Kibana\
**Created:** [July 27, 2022, 10:06am UTC](https://discuss.elastic.co/t/how-to-get-the-sum-in-time-of-values-in-lens/310735 "2022-07-27T10:06:06Z")\
**Posts on this page:** 1\
**Showing post:** 16

<div class="post-metadata">

**Author:** ![its-ogawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/its-ogawa/32/120829_2.png) [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\
**Post date:** [July 29, 2022, 10:54am UTC](https://discuss.elastic.co/t/how-to-get-the-sum-in-time-of-values-in-lens/310735/16 "2022-07-29T10:54:15Z")

</div>

> [@stephenb](#):
>
> BTW there is an nginx filebeat module that does all this for you... you would not need to use logstash just Filebeat -\> Elasticsearch and the data would all be nicely parse and typed and there are built in dashboards etc.
> 
> [Nginx module | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-nginx.html)

Filebeat's nginx module feature looks very attractive.

However, the index name seems to default to a form like `filebeat-7.12.0-2022.07.29-000001`.

On nginx, I have `access.log` and `error.log`, but I can't distinguish between them, so I want to change the index name.  
How can I do this?

I found the following article but cannot set the index name properly

> **[Configure the Elasticsearch output | Filebeat Reference \[7.0\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.0/elasticsearch-output.html#indices-option-es)**

I have added the following statement

```auto
# vi /etc/filebeat/modules.d/nginx.yml
- module: nginx
   access:
     enabled: true
     var.paths: ["/var/log/nginx/access.log"]

```

```auto
# vi /etc/filebeat/filebeat.yml
... snip ...
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  indices:
    - index: "else-httpd-access-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "nginx"
    - default: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
... snip ...

```

However, I get the following error.

```auto
# tail /var/log/filebeat/filebeat
... snip ...
2022-07-29T19:27:17.106+0900 ERROR instance/beat.go:971 Exiting: error initializing publisher: missing output.elasticsearch.indices.1.index
... snip ...

```

I would like to have index names such as `{my service name}-httpd-access-{date}`, `{my service name}-httpd-error-{date}` for each `access.log` and `error.log`, and for each outgoing server.

For example, kin-httpd-access-2022.07.29, kin-httpd-error-2022.07.29, els-httpd-access-2022.07.29, els-httpd-error-2022.07.29, etc ...

---

_[View the full topic](https://discuss.elastic.co/t/how-to-get-the-sum-in-time-of-values-in-lens/310735)._