# Message content based INDEX

**URL:** <https://discuss.elastic.co/t/message-content-based-index/15554>\
**Category:** Elasticsearch\
**Created:** [February 3, 2014, 8:06am UTC](https://discuss.elastic.co/t/message-content-based-index/15554 "2014-02-03T08:06:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![san](https://avatars.discourse-cdn.com/v4/letter/s/ba9def/32.png) [@san](https://discuss.elastic.co/u/san)\
**Post date:** [February 3, 2014, 8:06am UTC](https://discuss.elastic.co/t/message-content-based-index/15554/1 "2014-02-03T08:06:31Z")

</div>

I am an infant as far as Logstash+Elasticsearch is concerned. Could someone  
help me out on the following:

I need to create INDEX based on the content of ACTUAL MESSAGE part of a  
message forwarded to elasticsearch by Logstash.

For example:

\<6\> Jan 9 07:19:26 w2k8r233110 CEF:0|Trend Micro|Deep Security  
Manager|8.0.1310|173|Anti-Malware Quarantined File List  
Exported|3|src=10.100.33.110 suser=System target=10.100.33.111  
msg=Installation/Upgrade of Anti-Malware Component on Agent  
Succeeded.\n\nPrevious Version: \nCurrent Version: {1}\n

In this message, the actual message part is :

CEF:0|Trend Micro|Deep Security Manager|8.0.1310|173|Anti-Malware  
Quarantined File List Exported|3|src=10.100.33.110 suser=System  
target=10.100.33.111 msg=Installation/Upgrade of Anti-Malware Component on  
Agent Succeeded.\n\nPrevious Version: \nCurrent Version: {1}

I need to create index based on 10.100.33.110 so that all messages with  
this source comes in one document.

Thank you in advance.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5c8193fd-5e44-4405-8b89-b4aaff5ea654%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5c8193fd-5e44-4405-8b89-b4aaff5ea654%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:53am UTC](https://discuss.elastic.co/t/message-content-based-index/15554/2 "2017-07-06T01:53:17Z")

</div>