# Index name with local system date not using message @timestamp

**URL:** <https://discuss.elastic.co/t/index-name-with-local-system-date-not-using-message-timestamp/160981>\
**Category:** Logstash\
**Created:** [December 14, 2018, 11:31pm UTC](https://discuss.elastic.co/t/index-name-with-local-system-date-not-using-message-timestamp/160981 "2018-12-14T23:31:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![noobtoelks](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@noobtoelks](https://discuss.elastic.co/u/noobtoelks)\
**Post date:** [December 14, 2018, 11:31pm UTC](https://discuss.elastic.co/t/index-name-with-local-system-date-not-using-message-timestamp/160981/1 "2018-12-14T23:31:06Z")

</div>

Hi All,

I am new to ELK stack. I have logstash 6.5 setup using link and configuration below.

The question I have is how do I format the index name with either receive\_at or current OS date?

The reasons are because the message @timestamp I got from syslog is all over the place. It has past and future timestamp. I have a curator cronjob that deletes any index older than 7 days and it is base on index naming. Hence I need the index naming to be today date format.

Thanks for the help in advance!  
Newbie.

[https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html)

```
input {
  tcp {
    port => 5000
    type => syslog
  }
  udp {
    port => 5000
    type => syslog
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}

output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}
```

---

<div class="post-metadata">

**Author:** ![noobtoelks](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@noobtoelks](https://discuss.elastic.co/u/noobtoelks)\
**Post date:** [December 22, 2018, 9:01pm UTC](https://discuss.elastic.co/t/index-name-with-local-system-date-not-using-message-timestamp/160981/2 "2018-12-22T21:01:27Z")

</div>

I was looking at this post

[https://discuss.elastic.co/t/need-help-to-create-current-date-based-index-in-ls/42834](https://discuss.elastic.co/t/need-help-to-create-current-date-based-index-in-ls/42834)

but get the follow error

`[2018-12-22T20:32:21,539][ERROR][logstash.filters.ruby] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.`

so looking at this

[https://discuss.elastic.co/t/logstash-cannot-assign-correct-date-to-log-timestamp/89249/3](https://discuss.elastic.co/t/logstash-cannot-assign-correct-date-to-log-timestamp/89249/3)

here is the final working config

```
filter {
  ruby {
    code => 'event.set("[@metadata][now]", Time.now.strftime("%Y.%m.%d"))'
  }
}
output {
  elasticsearch {
    ...
    index => "logstash-%{[@metadata][now]}"
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 19, 2019, 9:01pm UTC](https://discuss.elastic.co/t/index-name-with-local-system-date-not-using-message-timestamp/160981/3 "2019-01-19T21:01:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.