# Insert Custom Field Name into Index Name after going through Solace Pubsub

**URL:** https://discuss.elastic.co/t/insert-custom-field-name-into-index-name-after-going-through-solace-pubsub/259639
**Category:** Logstash
**Created:** [December 25, 2020, 2:04pm UTC](https://discuss.elastic.co/t/insert-custom-field-name-into-index-name-after-going-through-solace-pubsub/259639 "2020-12-25T14:04:38Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ckough](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ckough/32/61892_2.png) [@ckough](https://discuss.elastic.co/u/ckough)
#### Post date: [December 25, 2020, 2:04pm UTC](https://discuss.elastic.co/t/insert-custom-field-name-into-index-name-after-going-through-solace-pubsub/259639/1 "2020-12-25T14:04:38Z")

</div>

Hi there

I'm using ELK 7.10.  
My test setup is as follows:  
filebeat (running in kibana) -\> logstash01 -\> solace pubsub+ -\> logstash02 -\> Elasticsearch -\> kibana

What I'm trying to accomplish:  
Insert custom fields created in filebeat into index name for logstash02 output to ES

This is my filebeat module yml:

```auto
- module: system
  syslog:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:
    input:
      processors:
        - add_fields:
            fields:
              env: dev
              app: kibana-sys
              type: filebeat
        - add_tags:
            tags: ["app", "syslog"]

```

My logstash01 logstash.yml file is:

```auto
input
{
  beats
  {
    port => "5044"
    ssl => true
    ssl_key => '/etc/logstash/certs/logstash.pkcs8.key'
    ssl_certificate => '/etc/logstash/certs/logstash.crt'

  }
}
output
{
  jms
  {
    delivery_mode => "persistent"
    destination => "elk-queue"
    jndi_name => "/jms/cf/my-jms"
    jndi_context => {
       'java.naming.factory.initial' => 'com.solacesystems.jndi.SolJNDIInitialContextFactory'
       'java.naming.security.principal' => 'default@elk-msg-vpn'
       'java.naming.provider.url' => 'tcp://10.10.10.191:55555'
        'java.naming.security.credentials' => 'Admincod3'
    }
    require_jars=> ['/var/lib/jms/commons-lang-2.6.jar',
                    '/var/lib/jms/sol-jms-10.9.1.jar',
                    '/var/lib/jms/geronimo-jms_1.1_spec-1.1.1.jar']
  }
}

```

And my logstash02 logstash yml file is:

```auto
input
{
  jms
  {
    include_header => false
    include_properties => false
    include_body => true
    destination => "elk-queue"
    jndi_name => "/jms/cf/my-jms"
    jndi_context => {
       'java.naming.factory.initial' => 'com.solacesystems.jndi.SolJNDIInitialContextFactory'
       'java.naming.security.principal' => 'default@elk-msg-vpn'
       'java.naming.provider.url' => 'tcp://10.10.10.191:55555'
       'java.naming.security.credentials' => 'Admincod3'
    }
    require_jars=> ['/usr/share/jms/commons-lang-2.6.jar',
                    '/usr/share/jms/sol-jms-10.9.1.jar',
                    '/usr/share/jms/geronimo-jms_1.1_spec-1.1.1.jar']
  }
}
filter
{
  json
  {
    source => "message"
    target => "parsed_message"
    tag_on_failure => ["_jsonparsefailure"]
  }
}
output
{
  elasticsearch
  {
    hosts => ["https://10.10.10.10:9200", "https://10.10.10.11:9200", "https://10.10.10.12:9200"]
    index => "%{[parsed_message][fields][app]}-%{+YYYY.MM.dd}"
    cacert => "/etc/logstash/certs/ca.crt"
    user => "logstash_writer"
    password => "Admincod3"
  }
}

```

I have attached a screencap below that shows parsed\_message.fields.app is actually captured in ES but I can't use it for my index name. The index name will be %{[parsed\_message][fields][app]}-2020-12-25 instead of kibana-sys-2020-12-25.

![Capture](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b2d9c81b24a1c30351c286eb0df82612db34c6bb.jpeg)

I have tried restarting Logstash and filebeat services too but no luck there. How can i do this?

Thanks and Merry X'mas from Singapore!  
ck

---

<div class="post-metadata">

### Author: ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [December 29, 2020, 1:31am UTC](https://discuss.elastic.co/t/insert-custom-field-name-into-index-name-after-going-through-solace-pubsub/259639/2 "2020-12-29T01:31:39Z")

</div>

Since you are able to see the field in Kibana, it means the field is available in logstash02. So I'm not sure why it's not being interpolated in the `elasticsearch` output config. Moving this post to the Logstash category.

Shaunak

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 26, 2021, 3:31am UTC](https://discuss.elastic.co/t/insert-custom-field-name-into-index-name-after-going-through-solace-pubsub/259639/3 "2021-01-26T03:31:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.