Is it possible to categorize index creation per source?

Elastic Stack Elasticsearch
1

Hello group,

As you may know in a Logstash => ES setup(default), the indexes appear
under /var/lib/elasticsearch../../indices directory on a per-day basis.
This makes index deletion on a day-based easier. Now, would it be possible
to facilitate the index creation according to the 'source' also, while
keeping the day-based index creation intact? By source I mean a 'server'.
I'll make it more clear:

I'd like to have indexes created both according to day AND server basis. As
per default setting indexes are now as Logstash-yyyy-mm-dd.
Would it be possible to have it as - mx-mail1-yyyy-mm-dd,
webserver1-yyyy-mm-dd etc where mx-mail1/webserver1 are the servers sending
logs to ES via Logstash?

I'd like to retain web-server logs for a more number of days than
mail-server logs is the reason why I'm asking.

Thanks in advance.
Subin

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Bump.

Subin
*
*

On Fri, Aug 2, 2013 at 8:54 PM, subin ksubins321@gmail.com wrote:

Hello group,

As you may know in a Logstash => ES setup(default), the indexes appear
under /var/lib/elasticsearch../../indices directory on a per-day basis.
This makes index deletion on a day-based easier. Now, would it be possible
to facilitate the index creation according to the 'source' also, while
keeping the day-based index creation intact? By source I mean a 'server'.
I'll make it more clear:

I'd like to have indexes created both according to day AND server basis.
As per default setting indexes are now as Logstash-yyyy-mm-dd.
Would it be possible to have it as - mx-mail1-yyyy-mm-dd,
webserver1-yyyy-mm-dd etc where mx-mail1/webserver1 are the servers sending
logs to ES via Logstash?

I'd like to retain web-server logs for a more number of days than
mail-server logs is the reason why I'm asking.

Thanks in advance.
Subin

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/eJfGmEVyjh8/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.