# Index by hostname?

**URL:** <https://discuss.elastic.co/t/index-by-hostname/317187>\
**Category:** Logstash\
**Created:** [October 21, 2022, 10:34am UTC](https://discuss.elastic.co/t/index-by-hostname/317187 "2022-10-21T10:34:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikolas1306](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolas1306/32/111507_2.png) [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\
**Post date:** [October 21, 2022, 10:34am UTC](https://discuss.elastic.co/t/index-by-hostname/317187/1 "2022-10-21T10:34:39Z")

</div>

```auto
      elasticsearch {
			hosts => ["localhost:9200"]
                      
			index => "logstash-%{[host][hostname]}%{+YYYY.MM.dd}"
		 }

```

but have

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/1/013e9104063b610866f942bcc059376b98b315ff.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 21, 2022, 10:52pm UTC](https://discuss.elastic.co/t/index-by-hostname/317187/2 "2022-10-21T22:52:33Z")

</div>

> [@Nikolas1306](#):
>
> `index => "logstash-%{[host][hostname]}%{+YYYY.MM.dd}"`

The syntax is correct... (even though I think you want another `-` between the hostname and date)

What you are seeing is when that field does not exist / logstash is not able to get the host name from the host or for some reason your pipeline has corrupted or deleted that field.

When logstash can not access the fields is substitutes the literal.

If you do a simple in the output you will see the fields you can work with.

` stdout {}`

Somtime that field ends up in [host][name]

---

<div class="post-metadata">

**Author:** ![Nikolas1306](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolas1306/32/111507_2.png) [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\
**Post date:** [October 22, 2022, 7:14am UTC](https://discuss.elastic.co/t/index-by-hostname/317187/3 "2022-10-22T07:14:25Z")

</div>

i've resolved with

`index => "logstash-%{[host][name]}%{+YYYY.MM.dd}"`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2022, 7:14am UTC](https://discuss.elastic.co/t/index-by-hostname/317187/4 "2022-11-19T07:14:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.