Logstash output csv index name

Elastic Stack Logstash
1

I'm using Csv output plugin | Logstash Reference to write events to file on disk.

snippet from my logstash configuration:

output {
  csv {
    fields => ["@timestamp","XXX","YYY","ZZZ"]
    path => "/tmp/XXX-%{+YYYY-MM-dd}.csv"
  }
}

Is there a way to incorporate _index name into file name somehow?

2

Is that a field? You can reference fields in the event using the %{some_field} notation.

3

_index is part of all docs.

4

Once they are docs, that's true, but you didn't say that you were pulling data out of elasticsearch :slight_smile: Set docinfo => true on the elasticsearch input and refer to %{[@metadata][_index]} in the path string.

5

yup, that's exactly what I was looking for)

Thanks!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.