# Logstash-forwarder

**URL:** <https://discuss.elastic.co/t/logstash-forwarder/240204>\
**Category:** Logstash\
**Created:** [July 7, 2020, 6:50pm UTC](https://discuss.elastic.co/t/logstash-forwarder/240204 "2020-07-07T18:50:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mustafa.husny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustafa.husny/32/77154_2.png) [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\
**Post date:** [July 7, 2020, 6:50pm UTC](https://discuss.elastic.co/t/logstash-forwarder/240204/1 "2020-07-07T18:50:32Z")

</div>

I am using logstash forwarder to ship my logs from AIX machine to my ELK stack on linux machine  
I am trying to make an index as (hostname-ip) but it is not working  
my config is as below

input {  
lumberjack {  
port =\> 5043  
type =\> "logs"  
ssl\_certificate =\> "/etc/logstash/conf.d/lumberjack.crt"  
ssl\_key =\> "/etc/logstash/conf.d/lumberjack.key"  
}  
}

output {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "%{[host][hostname]}-%[ip]"  
user =\> "elastic"  
password =\> "changeme"  
}  
}

how can I get my index in this form

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 7, 2020, 7:29pm UTC](https://discuss.elastic.co/t/logstash-forwarder/240204/2 "2020-07-07T19:29:13Z")

</div>

> [@mustafa.husny](#):
>
> index =\> "%{[host][hostname]}-%[ip]"

Try

```
index => "%{[host][hostname]}-%{ip}"

```

---

<div class="post-metadata">

**Author:** ![mustafa.husny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustafa.husny/32/77154_2.png) [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\
**Post date:** [July 8, 2020, 6:27am UTC](https://discuss.elastic.co/t/logstash-forwarder/240204/3 "2020-07-08T06:27:23Z")

</div>

unfortunately not working  
in kibana (%{[host][hostname]}-%[ip])

---

<div class="post-metadata">

**Author:** ![mustafa.husny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustafa.husny/32/77154_2.png) [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\
**Post date:** [July 27, 2020, 7:07am UTC](https://discuss.elastic.co/t/logstash-forwarder/240204/4 "2020-07-27T07:07:19Z")

</div>

My bad  
it should be host not hostname  
index =\> "logs-%{[host]}-%{+yyyy.MM.dd}"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2020, 7:10am UTC](https://discuss.elastic.co/t/logstash-forwarder/240204/5 "2020-08-24T07:10:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.