# Logstash different index names per input?

**URL:** <https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806>\
**Category:** Logstash\
**Created:** [October 12, 2016, 12:59pm UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806 "2016-10-12T12:59:21Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [October 12, 2016, 12:59pm UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806/1 "2016-10-12T12:59:21Z")

</div>

I have this logstash config but beats documents get created with index "log-2016.10.12" that is the document\_tpye instead of filebeat-xxx. Any idea on how i can set the index name to filebeat and snmptrap index to snmptrap?

```
input {
        beats {
                type => "filebeat"
                port => 5044
        }

        snmptrap {
                type => "snmptrap"
                community => "public"
                port => 8162
        }
}

### Add your filters / logstash plugins configuration here

filter {
  if "_grokparsefailure" in [tags] {
        drop {}
  }
}

output {
        elasticsearch {
                hosts => "elasticsearch:9200"
                user => "elastic"
                index => "%{type}-%{+YYYY.MM.dd}"
        }
}
```

---

<div class="post-metadata">

**Author:** ![caecilie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/caecilie/32/12472_2.png) [@caecilie](https://discuss.elastic.co/u/caecilie)\
**Post date:** [October 12, 2016, 1:17pm UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806/2 "2016-10-12T13:17:14Z")

</div>

index =\> "%{[@metadata][type]}-%{+YYYY.MM.dd}"

I had the same idea a few hours ago 🙂

---

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [October 12, 2016, 4:32pm UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806/3 "2016-10-12T16:32:58Z")

</div>

but for smtptraps input metadata type is not set, isnt it? I want to set different index for smtptraps filebeat and metricbeat.

---

<div class="post-metadata">

**Author:** ![caecilie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/caecilie/32/12472_2.png) [@caecilie](https://discuss.elastic.co/u/caecilie)\
**Post date:** [October 13, 2016, 6:28am UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806/4 "2016-10-13T06:28:00Z")

</div>

I only use filebeat, try:  
index =\> "%{[type]}-%{+YYYY.MM.dd}"

---

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [October 13, 2016, 10:47am UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806/5 "2016-10-13T10:47:37Z")

</div>

No, it doesnt work, still create log-2016.10.13 index. Any one else?

---

<div class="post-metadata">

**Author:** ![caecilie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/caecilie/32/12472_2.png) [@caecilie](https://discuss.elastic.co/u/caecilie)\
**Post date:** [October 13, 2016, 11:18am UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806/6 "2016-10-13T11:18:20Z")

</div>

Try to set the document\_typ in filebeat to "filebeat", default is log  
[https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html)

---

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [October 13, 2016, 11:19am UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806/7 "2016-10-13T11:19:49Z")

</div>

is there a way to set document\_type globalyl in filebeat? I have like 40 prospectors and dont want to include it on each of them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806/8 "2017-07-06T04:34:26Z")

</div>