# Index names including yyyy-mm-dd **URL:** \ **Category:** Elasticsearch\ **Created:** [January 16, 2019, 2:27pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481 "2019-01-16T14:27:10Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![gormanst](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gormanst](https://discuss.elastic.co/u/gormanst)\ **Post date:** [January 16, 2019, 2:27pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/1 "2019-01-16T14:27:11Z")
I am new to elasticsearch and am trying to figure out index management. I index smallish documents continuously for a week. I would like the index names to include the date in their name along with a project specifier i.e. foobar-yyyy-mm-dd It doesn't appear to be a simple thing to do. Is this accomplished by using a template for foobar indexes and then alias all foobar indices to some umbrella term for searching? If this is correct than I assume I use curator to prune? I just want to make sure I am not over complicating an otherwise simple thing. Thank you for reading this and your thoughts. sg ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [January 16, 2019, 2:31pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/2 "2019-01-16T14:31:26Z")
Logstash and Filebeat will let you template the Elasticsearch index names. E.g. in my Logstash config ``` index => "%{[@metadata][log_prefix]}-%{[@metadata][index]}-%{+YYYY.MM.dd}" ``` How do you ship your data to Elasticsearch? ---
**Author:** ![gormanst](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gormanst](https://discuss.elastic.co/u/gormanst)\ **Post date:** [January 16, 2019, 2:34pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/3 "2019-01-16T14:34:40Z")
If I understand "ship" correctly, I ingest data using java? ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [January 16, 2019, 2:35pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/4 "2019-01-16T14:35:58Z")
Directly to Elasticsearch? You could put everything through Logstash and get index creation and naming "for free" 🙂 ---
**Author:** ![gormanst](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gormanst](https://discuss.elastic.co/u/gormanst)\ **Post date:** [January 16, 2019, 2:41pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/5 "2019-01-16T14:41:04Z")
Hrm. That seems strange but remember I am new to elasticsearch. Can you give me a couple bread crumbs to follow? I use the java RestHighLevelClient to index. How do you "put" everything through logstash? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [January 16, 2019, 2:41pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/6 "2019-01-16T14:41:22Z")
Curator would indeed be the tool of choice to prune. ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [January 16, 2019, 2:49pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/7 "2019-01-16T14:49:39Z")
> [@gormanst](#): > > Can you give me a couple bread crumbs to follow? Adding Logstash to the mix is of course one more service to worry about. What you get is a service that can talk fluently with Elasticsearch, can load balance over several ES nodes and it will create and name the ES indices for you. You can also do more advanced stuff like enrich your logs as well. As you are shipping directly to Elasticsearch your data has to be in JSON. To run Logstash, configure a TCP or UDP input that accepts JSON. From the [TCP input plugin docs](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-tcp.html) ``` input { tcp { port => 12345 codec => json } } ``` The filter section would be just ``` filter {} ``` The output is [Elasticsearch](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html) output { ``` elasticsearch { hosts => ["127.0.0.1:9200","127.0.0.2:9200"] index => "foo-%{+YYYY.MM.dd}" } } ``` So, instead of `RestHighLevelClient` shipping to Elasticsearch, something like `hostname:9200`, you ship to `logstashhost:12345` ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [January 16, 2019, 2:53pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/8 "2019-01-16T14:53:17Z")
You can read more here [Logging directly to elasticsearch](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702) ---
**Author:** ![gormanst](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gormanst](https://discuss.elastic.co/u/gormanst)\ **Post date:** [January 16, 2019, 2:53pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/9 "2019-01-16T14:53:30Z")
thank you ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 16, 2019, 2:58pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/10 "2019-01-16T14:58:39Z")
I'd not use logstash when the source of data is available from a Java application. The index name is something you can easily compute in Java. There's no need IMO to add logstash. But may be I'm missing something. What kind of data are you indexing @gormanst? ---
**Author:** ![gormanst](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gormanst](https://discuss.elastic.co/u/gormanst)\ **Post date:** [January 16, 2019, 3:02pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/11 "2019-01-16T15:02:54Z")
I am indexing small blocks of json data received from an outside application via REST. I make some minor transformations then index. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 16, 2019, 3:41pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/12 "2019-01-16T15:41:46Z")
So just compute the index name in your REST application. ---
**Author:** ![gormanst](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gormanst](https://discuss.elastic.co/u/gormanst)\ **Post date:** [January 16, 2019, 3:57pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/13 "2019-01-16T15:57:47Z")
That's kind of where my original question was headed. I just wanted to make sure I was not overly complicating things. So I should create a template with an alias (for searching) and programatically figure out that I want to index to foobar-yyyy-mm-dd. Finally, use Curator to prune off old data? Again thanks for your thoughts on this. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 16, 2019, 4:14pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/14 "2019-01-16T16:14:53Z")
Exactly what I'd do. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 13, 2019, 4:14pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481/15 "2019-02-13T16:14:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.