# Logstash sprintf formatting for elasticsearch output plugin does not seem to resolve

**URL:** https://discuss.elastic.co/t/logstash-sprintf-formatting-for-elasticsearch-output-plugin-does-not-seem-to-resolve/159025
**Category:** Elasticsearch
**Created:** [December 2, 2018, 5:38am UTC](https://discuss.elastic.co/t/logstash-sprintf-formatting-for-elasticsearch-output-plugin-does-not-seem-to-resolve/159025 "2018-12-02T05:38:44Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![houdinisparks](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@houdinisparks](https://discuss.elastic.co/u/houdinisparks)
#### Post date: [December 2, 2018, 5:38am UTC](https://discuss.elastic.co/t/logstash-sprintf-formatting-for-elasticsearch-output-plugin-does-not-seem-to-resolve/159025/1 "2018-12-02T05:38:44Z")

</div>

I am having trouble using sprintf to reference the event fields in the elasticsearch output plugin and I'm not sure why. Below is the event received from Filebeat and sent to Elasticsearch after filtering is complete:

```
    {
              "beat" => {
            "hostname" => "ca86fed16953",
                "name" => "ca86fed16953",
             "version" => "6.5.1"
        },
        "@timestamp" => 2018-12-02T05:13:21.879Z,
              "host" => {
            "name" => "ca86fed16953"
        },
              "tags" => [
            [0] "beats_input_codec_plain_applied",
            [1] "_grokparsefailure"
        ],
            "fields" => {
            "env" => "DEV"
        },
            "source" => "/usr/share/filebeat/dockerlogs/logstash_DEV.log",
          "@version" => "1",
        "prospector" => {
            "type" => "log"
        },
            "bgp_id" => "42313900",
           "message" => "{<some message here>}",
            "offset" => 1440990627,
             "input" => {
            "type" => "log"
        },
            "docker" => {
            "container" => {
                "id" => "logstash_DEV.log"
            }
        }
    }

```

I am trying to index the files this based on filebeat's environment. Here is my config file:

```
input {
  http { }
  beats {
    port => 5044
  }
}

filter {
  grok {
    patterns_dir => ["/usr/share/logstash/pipeline/patterns"]
    break_on_match => false
    match => { "message" => ["%{RUBY_LOGGER}"]
             }
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "%{[fields][env]}-%{+yyyy.MM.dd}"
  }
  stdout { codec => rubydebug }
}

```

I would think the referenced event fields would have already been populated by the time it reaches the elasticsearch output plugin. However, on the kibana end, it doesnt not register the formatted index. Instead, its since like this:

[![enter image description here](https://i.stack.imgur.com/bGwTT.png)](https://i.stack.imgur.com/bGwTT.png)

What have I done wrong?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 2, 2018, 10:38am UTC](https://discuss.elastic.co/t/logstash-sprintf-formatting-for-elasticsearch-output-plugin-does-not-seem-to-resolve/159025/2 "2018-12-02T10:38:45Z")

</div>

Index names must be lowercased, so I believe you will need to lowercase the `fields.env` field if you want to use it. If you look in Kibana I suspect you will find that the data in the index you found actually might be coming from the http input and does not have the `fields.env` field set.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 30, 2018, 10:38am UTC](https://discuss.elastic.co/t/logstash-sprintf-formatting-for-elasticsearch-output-plugin-does-not-seem-to-resolve/159025/3 "2018-12-30T10:38:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.