# Is it possible to categorize index creation per source? **URL:** \ **Category:** Elasticsearch\ **Created:** [August 2, 2013, 3:24pm UTC](https://discuss.elastic.co/t/is-it-possible-to-categorize-index-creation-per-source/13045 "2013-08-02T15:24:27Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [August 2, 2013, 3:24pm UTC](https://discuss.elastic.co/t/is-it-possible-to-categorize-index-creation-per-source/13045/1 "2013-08-02T15:24:27Z")
Hello group, As you may know in a Logstash =\> ES setup(default), the indexes appear under /var/lib/elasticsearch../../indices directory on a per-day basis. This makes index deletion on a day-based easier. Now, would it be possible to facilitate the index creation according to the 'source' also, while keeping the day-based index creation intact? By source I mean a 'server'. I'll make it more clear: I'd like to have indexes created both according to day AND server basis. As per default setting indexes are now as Logstash-yyyy-mm-dd. Would it be possible to have it as - mx-mail1-yyyy-mm-dd, webserver1-yyyy-mm-dd etc where mx-mail1/webserver1 are the servers sending logs to ES via Logstash? I'd like to retain web-server logs for a more number of days than mail-server logs is the reason why I'm asking. Thanks in advance. Subin -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [August 28, 2013, 5:36am UTC](https://discuss.elastic.co/t/is-it-possible-to-categorize-index-creation-per-source/13045/2 "2013-08-28T05:36:13Z")
Bump. * * * Subin \* \* On Fri, Aug 2, 2013 at 8:54 PM, subin [ksubins321@gmail.com](mailto:ksubins321@gmail.com) wrote: > Hello group, > > As you may know in a Logstash =\> ES setup(default), the indexes appear > under /var/lib/elasticsearch../../indices directory on a per-day basis. > This makes index deletion on a day-based easier. Now, would it be possible > to facilitate the index creation according to the 'source' also, while > keeping the day-based index creation intact? By source I mean a 'server'. > I'll make it more clear: > > I'd like to have indexes created both according to day AND server basis. > As per default setting indexes are now as Logstash-yyyy-mm-dd. > Would it be possible to have it as - mx-mail1-yyyy-mm-dd, > webserver1-yyyy-mm-dd etc where mx-mail1/webserver1 are the servers sending > logs to ES via Logstash? > > I'd like to retain web-server logs for a more number of days than > mail-server logs is the reason why I'm asking. > > Thanks in advance. > Subin > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/eJfGmEVyjh8/unsubscribe](https://groups.google.com/d/topic/elasticsearch/eJfGmEVyjh8/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:19am UTC](https://discuss.elastic.co/t/is-it-possible-to-categorize-index-creation-per-source/13045/3 "2017-07-06T02:19:24Z")
Closed on July 6, 2017, 2:19am UTC