# Logtash adding filename as index name
**URL:** https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487
**Category:** Logstash
**Created:** [May 11, 2018, 2:08pm UTC](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487 "2018-05-11T14:08:44Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Dhivya\_Buvanesh](https://discuss.elastic.co/u/Dhivya_Buvanesh)
#### Post date: [May 11, 2018, 2:08pm UTC](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487/1 "2018-05-11T14:08:44Z")
Hi,
I want the "index" name to be my filename when uploading to elastic via Logtash, Searched widely but unable to get a working solution. Need help how we can use the grok to set the index name as per filename
I tried the below configs but not working
**CONFIG: 1**
Logtash.conf
input {
file {
path =\> "C:/logtash/\*"
start\_position =\> "beginning"
}
}
filter {
# Drop Elasticsearch Bulk API control lines
if ([message] =~ "{"index") {
drop {}
}
```
json {
source => "message"
remove_field => "message"
}
grok {
match => [
"source", "C:\\logtash\\%{DATA:myindex}.json"
]
}
```
}
output {
elasticsearch {
hosts =\> "localhost:9200"
document\_type =\> "pcap\_file"
manage\_template =\> false
index =\> "%{[myindex]}"
}
}
**CONFIG-2**
input {
file {
path =\> "C:/logtash/\*"
start\_position =\> "beginning"
}
}
filter {
# Drop Elasticsearch Bulk API control lines
if ([message] =~ "{"index") {
drop {}
}
```
json {
source => "message"
remove_field => "message"
}
grok {
match => ["path","%{GREEDYDATA}/%{GREEDYDATA:filename}\.json"]
}
```
}
output {
elasticsearch {
hosts =\> "localhost:9200"
document\_type =\> "pcap\_file"
manage\_template =\> false
index =\> filename
}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 11, 2018, 2:42pm UTC](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487/2 "2018-05-11T14:42:41Z")
```
grok { match => ["path", "/(?[^/]+).json" ] }
```
will pull out the filename, then you can reference it using 'index =\> "%{filename}"'.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 11, 2018, 2:58pm UTC](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487/3 "2018-05-11T14:58:17Z")
You have not explained the use case, but creating a large number of small indexes is not an efficient way to do things.
---
### Author:  [@Dhivya\_Buvanesh](https://discuss.elastic.co/u/Dhivya_Buvanesh)
#### Post date: [May 11, 2018, 4:29pm UTC](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487/5 "2018-05-11T16:29:17Z")
Thank you, this worked!!, our usecase is similar to [https://www.elastic.co/blog/analyzing-network-packets-with-wireshark-elasticsearch-and-kibana](https://www.elastic.co/blog/analyzing-network-packets-with-wireshark-elasticsearch-and-kibana)
we want to group the packets based on the packet filename and categorize
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 8, 2018, 4:29pm UTC](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487/6 "2018-06-08T16:29:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.