# Index Mapping/Routing Help **URL:** \ **Category:** Elasticsearch\ **Created:** [February 17, 2014, 7:02pm UTC](https://discuss.elastic.co/t/index-mapping-routing-help/15855 "2014-02-17T19:02:05Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Eric\_Luellen](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Eric\_Luellen](https://discuss.elastic.co/u/Eric_Luellen)\ **Post date:** [February 17, 2014, 7:02pm UTC](https://discuss.elastic.co/t/index-mapping-routing-help/15855/1 "2014-02-17T19:02:05Z")
Hello, Currently I have the following setup. Syslog --\> Logstash --\> ElasticSearch --\> Kibana Logstash is creating a daily index "/etc/elasticsearch/data/test-elasticsearch/nodes/0/indices/logstash-2014.02.04" and I'm viewing all of the logs through Kibana. We want to set up some user based access control using the kibana-authentication-proxy setup due to it supporting - Per-user kibana index supported. now you can use index kibana-int-userA for user A and kibana-int-userB for user B I'd like to make it where all logs coming in from logstash with a location of "/var/log/UNIX/\*.log" get sent to a new index of unix-2014.02.04 instead of the logstash one. That way I can use the Kibana auth proxy to give my UNIX users access only to their logs. I've read a little about creating the mappings but wasn't sure how to tie it all together. I saw you could do various things with API calls but was curious if I could set all of this up in the elasticsearch.yml file from the start. Thanks, Eric -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/56e2fc09-c179-4839-a23f-67a805f563ce%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/56e2fc09-c179-4839-a23f-67a805f563ce%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Binh\_Ly](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@Binh\_Ly](https://discuss.elastic.co/u/Binh_Ly)\ **Post date:** [February 18, 2014, 5:53pm UTC](https://discuss.elastic.co/t/index-mapping-routing-help/15855/2 "2014-02-18T17:53:22Z")
You should be able to use the input type to direct log events to specific indexes. For example: input { file { type =\> "unixlogs" path =\> "/var/log/UNIX/\*.log" } } output { if [type] == "unixlogs" { elasticsearch { host =\> "localhost" index =\> "unix-%{+YYYY.MM.dd}" } } } -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5107e623-4bf5-46d3-8d9c-83de77f95bd5%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5107e623-4bf5-46d3-8d9c-83de77f95bd5%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Eric\_Luellen](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Eric\_Luellen](https://discuss.elastic.co/u/Eric_Luellen)\ **Post date:** [February 18, 2014, 9:49pm UTC](https://discuss.elastic.co/t/index-mapping-routing-help/15855/3 "2014-02-18T21:49:41Z")
Thanks for that information. When I'm looking in Kibana now, it's showing the correct type but it still shows the index as the original logstash-2014-02-18. Not sure why it isn't showing the unix-date index. If I look at Elasticsearch, I can see that it did create the new index I told it to though. On Tuesday, February 18, 2014 12:53:22 PM UTC-5, Binh Ly wrote: > You should be able to use the input type to direct log events to specific > indexes. For example: > > input { > file { > type =\> "unixlogs" > path =\> "/var/log/UNIX/\*.log" > } > } > > output { > if [type] == "unixlogs" { > elasticsearch { > host =\> "localhost" > index =\> "unix-%{+YYYY.MM.dd}" > } > } > } -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5f034ce7-68c9-4f56-918b-bc4c887f74fb%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5f034ce7-68c9-4f56-918b-bc4c887f74fb%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Binh\_Ly](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@Binh\_Ly](https://discuss.elastic.co/u/Binh_Ly)\ **Post date:** [February 18, 2014, 9:52pm UTC](https://discuss.elastic.co/t/index-mapping-routing-help/15855/4 "2014-02-18T21:52:38Z")
Yup, you will need to go into your Kibana dashboard - top right corner - Configure Dashboard | Index and change the settings there to point to your new index(es) instead of the default logstash-\* indexes. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/457a1b21-0768-44a9-a1c3-f8766683ec66%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/457a1b21-0768-44a9-a1c3-f8766683ec66%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Ronny\_Vaningh](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@Ronny\_Vaningh](https://discuss.elastic.co/u/Ronny_Vaningh)\ **Post date:** [February 18, 2014, 10:48pm UTC](https://discuss.elastic.co/t/index-mapping-routing-help/15855/5 "2014-02-18T22:48:24Z")
Hi Eric I believe you might find the following blog post handy > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. Regards Ronny On 18 February 2014 22:52, Binh Ly [binh@hibalo.com](mailto:binh@hibalo.com) wrote: > Yup, you will need to go into your Kibana dashboard - top right corner - > Configure Dashboard | Index and change the settings there to point to your > new index(es) instead of the default logstash-\* indexes. > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/457a1b21-0768-44a9-a1c3-f8766683ec66%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/457a1b21-0768-44a9-a1c3-f8766683ec66%40googlegroups.com) > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CACA5U5kFfwHOnB3B79M2HF%2BLoYACP3fH4dYUXMmKPmHp1UxjyA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CACA5U5kFfwHOnB3B79M2HF%2BLoYACP3fH4dYUXMmKPmHp1UxjyA%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Eric\_Luellen](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Eric\_Luellen](https://discuss.elastic.co/u/Eric_Luellen)\ **Post date:** [February 19, 2014, 2:59pm UTC](https://discuss.elastic.co/t/index-mapping-routing-help/15855/6 "2014-02-19T14:59:48Z")
Thanks! What was throwing me off is that I'm still having the UNIX logs also write to logstash-date as well so I was seeing that information in my main dashboard. I wasn't thinking about it writing 2 different times. Thanks again. On Tuesday, February 18, 2014 4:52:38 PM UTC-5, Binh Ly wrote: > Yup, you will need to go into your Kibana dashboard - top right corner - > Configure Dashboard | Index and change the settings there to point to your > new index(es) instead of the default logstash-\* indexes. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/aa721942-fe0b-4c7c-a2dc-8e95a1abcc02%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/aa721942-fe0b-4c7c-a2dc-8e95a1abcc02%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:49am UTC](https://discuss.elastic.co/t/index-mapping-routing-help/15855/7 "2017-07-06T01:49:01Z")
Closed on July 6, 2017, 1:49am UTC