# Ingest Node Index According to Timestamp
**URL:** https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438
**Category:** Elasticsearch
**Created:** [November 29, 2016, 6:51am UTC](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438 "2016-11-29T06:51:26Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@wenyao](https://discuss.elastic.co/u/wenyao)
#### Post date: [November 29, 2016, 6:51am UTC](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438/1 "2016-11-29T06:51:26Z")
I just upgraded to version 5. Currently i am using Filebeat to send loglines into logstash which ill in turn filter the data and pass the document into elasticsearch. Now, I am hoping to use the elasticsearch ingest node in place of logstash (i.e. filebeat -\> ingest node).
I understand that by using the ingest nodes, i will have to specify the rules and patterns in the pipeline processors. However, i cant seem to find any documentation regarding what index will my document(s) be sent to.
Is it possible for me to define which index to store the document? I want to define it according to the value from a field (i.e. timestamp)
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 29, 2016, 7:08am UTC](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438/2 "2016-11-29T07:08:20Z")
So filebeat will send data to `filebeat-YYYY-MM-DD`.
To do that it will use a `?pipeline=YOURPIPELINE` http parameter.
The pipeline will index the document in the index this document is sent to. Here in `filebeat-YYYY-MM-DD`. Note that in a pipeline, you can change `_index` value which by default contains the index name where the document is supposed to be sent to.
Makes sense?
---
### Author:  [@wenyao](https://discuss.elastic.co/u/wenyao)
#### Post date: [November 29, 2016, 7:27am UTC](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438/3 "2016-11-29T07:27:35Z")
I don't understand what you mean exactly.
The thing is that the logfile can contain messages from different days (i.e. different timestamp). Previously in logstash i could name my index dynamically depending on the value of the fields it receives. Is that possible in this case?
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 29, 2016, 7:42am UTC](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438/4 "2016-11-29T07:42:03Z")
I did not try it but I believe you can use [https://www.elastic.co/guide/en/elasticsearch/reference/current/date-index-name-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/date-index-name-processor.html)
---
### Author:  [@wenyao](https://discuss.elastic.co/u/wenyao)
#### Post date: [November 29, 2016, 10:31am UTC](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438/5 "2016-11-29T10:31:27Z")
I just tried that out and that is exactly what i was looking for. Thank you very much!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 27, 2016, 10:31am UTC](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438/6 "2016-12-27T10:31:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.