# Is there a way to add "userdata" to an input-definition?

**URL:** <https://discuss.elastic.co/t/is-there-a-way-to-add-userdata-to-an-input-definition/90674>\
**Category:** Logstash\
**Created:** [June 23, 2017, 5:37pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-add-userdata-to-an-input-definition/90674 "2017-06-23T17:37:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![UnitedMarsupials](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/unitedmarsupials/32/19429_2.png) [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\
**Post date:** [June 23, 2017, 5:37pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-add-userdata-to-an-input-definition/90674/1 "2017-06-23T17:37:32Z")

</div>

I'd like the data read from a particular input to be sent to a different index in ElasticSearch. I tried the following, but logstash refuses it for syntax error -- setting `@metadata` in an input-definition is, apparently, not allowed:

```
input {
	unix {
          path => "/tmp/logstash-cdn1.sock"
          [@metadata][esindex] => "cdn1"
	}
}
...
output {
    elasticsearch {
      hosts => ["localhost:9200"]
      index => "logstash-%{[@metadata][esindex]}-%{+YYYY.MM.dd}"
    }
}

```

I know, I can set `type`, but we are already using that for something else. I can also set it in `filter`, but that will happen for each event slowing things down a bit. Can it be set once per `input` somehow?

---

<div class="post-metadata">

**Author:** ![Jack\_Judge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_judge/32/85499_2.png) [@Jack\_Judge](https://discuss.elastic.co/u/Jack_Judge)\
**Post date:** [June 23, 2017, 6:42pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-add-userdata-to-an-input-definition/90674/2 "2017-06-23T18:42:40Z")

</div>

Would adding a tag at the input help ?

input {  
unix {  
path =\> "/tmp/logstash-cdn1.sock"  
tags =\> ["cdn1"]  
}  
}

---

<div class="post-metadata">

**Author:** ![UnitedMarsupials](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/unitedmarsupials/32/19429_2.png) [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\
**Post date:** [June 23, 2017, 6:59pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-add-userdata-to-an-input-definition/90674/3 "2017-06-23T18:59:13Z")

</div>

No, because a tag being there is only a boolean -- I'd like the data to store the actual value, a string...

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 24, 2017, 7:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-add-userdata-to-an-input-definition/90674/4 "2017-06-24T19:14:25Z")

</div>

You can certainly set any field values in the input (metadata or not) but you must use the correct syntax for adding fields:

```nohighlight
input {
  unix {
    ...
    add_field => {
      "[@metadata][esindex]" => "cdn1"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2017, 7:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-add-userdata-to-an-input-definition/90674/5 "2017-07-22T19:14:35Z")

</div>

Closed on July 22, 2017, 7:14pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.