# Logstash - Configuration

**URL:** <https://discuss.elastic.co/t/logstash-configuration/132088>\
**Category:** Logstash\
**Created:** [May 16, 2018, 10:06am UTC](https://discuss.elastic.co/t/logstash-configuration/132088 "2018-05-16T10:06:14Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sunillinus](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)\
**Post date:** [May 16, 2018, 10:06am UTC](https://discuss.elastic.co/t/logstash-configuration/132088/1 "2018-05-16T10:06:14Z")

</div>

Hi,  
I am using elasticsearch, kibana and logstash for log analysis. All are of 6.2.4 versions.

My Question is :  
I have different log files for a different purpose in one folder. Let's say "Sample" folder.  
Under Sample folder, I have log files as shown below  
D:/Sample/RS20180513.log  
D:/Sample/OS20180513.log  
D:/Sample/RS20180514.log  
D:/Sample/OS20180514.log  
D:/Sample/RS20180515.log  
D:/Sample/OS20180515.log  
etc..

All log filenames are created with a particular date.

How should be the configuration file so that when I run logstash from command prompt, it should create different indexes with the name as log filename for each log file in kibana.

---

<div class="post-metadata">

**Author:** ![Dvikas](https://avatars.discourse-cdn.com/v4/letter/d/a9adbd/32.png) [@Dvikas](https://discuss.elastic.co/u/Dvikas)\
**Post date:** [May 16, 2018, 10:22am UTC](https://discuss.elastic.co/t/logstash-configuration/132088/2 "2018-05-16T10:22:10Z")

</div>

r u not using filebeat?

---

<div class="post-metadata">

**Author:** ![Sunillinus](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)\
**Post date:** [May 16, 2018, 3:08pm UTC](https://discuss.elastic.co/t/logstash-configuration/132088/3 "2018-05-16T15:08:20Z")

</div>

No I'm not using filebeat.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 16, 2018, 7:37pm UTC](https://discuss.elastic.co/t/logstash-configuration/132088/4 "2018-05-16T19:37:27Z")

</div>

Use a grok or dissect filter to extract the filename from the field containing the input filename (`source`, is it?), examples have been posted in the past, then reference that field in the `index` option of your elasticsearch output.

---

<div class="post-metadata">

**Author:** ![Sunillinus](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)\
**Post date:** [May 17, 2018, 3:43am UTC](https://discuss.elastic.co/t/logstash-configuration/132088/5 "2018-05-17T03:43:40Z")

</div>

Hi magnus,

Actually I'm new to this ELK. Here is my configuration file. Can you please edit this configuration to match my requirement.

input {  
file {  
path =\> ["D:/Sample/OS\*"]  
start\_position =\> "beginning"   
sincedb\_path =\> "/dev/null"  
}  
file{  
path =\> ["D:/Sample/RS\*"]  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "logstash-%{+YYYY.MM.dd}"  
}  
stdout {}  
}

---

<div class="post-metadata">

**Author:** ![Sunillinus](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)\
**Post date:** [May 21, 2018, 4:55am UTC](https://discuss.elastic.co/t/logstash-configuration/132088/6 "2018-05-21T04:55:16Z")

</div>

Hi @magnusbaeck

Can you please help me on how to achieve this.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 21, 2018, 6:30am UTC](https://discuss.elastic.co/t/logstash-configuration/132088/7 "2018-05-21T06:30:10Z")

</div>

I don't have time to write a config from scratch, but I can help iron out minor problems with a reasonably complete configuration.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2018, 6:30am UTC](https://discuss.elastic.co/t/logstash-configuration/132088/8 "2018-06-18T06:30:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.