# Newbie question - can you create a new index and parser for a log that has a certain string?

**URL:** <https://discuss.elastic.co/t/newbie-question-can-you-create-a-new-index-and-parser-for-a-log-that-has-a-certain-string/381138>\
**Category:** Elastic Search\
**Created:** [August 19, 2025, 4:44pm UTC](https://discuss.elastic.co/t/newbie-question-can-you-create-a-new-index-and-parser-for-a-log-that-has-a-certain-string/381138 "2025-08-19T16:44:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![meatwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/meatwad/32/36031_2.png) [@meatwad](https://discuss.elastic.co/u/meatwad)\
**Post date:** [August 19, 2025, 4:44pm UTC](https://discuss.elastic.co/t/newbie-question-can-you-create-a-new-index-and-parser-for-a-log-that-has-a-certain-string/381138/1 "2025-08-19T16:44:08Z")

</div>

Hi there,

I apologize for the newbie question but I’m ingesting CCURE badging logs that I’ve tagged by appending the “CCURE” string at the end of each log that is just CSV output. For example:

`2025-08-19 16:04:00.000,Smith, John,BREAKROOM HALLWAY,CardAdmitted,CCURE`

There’s also the following field that identifies these logs:

`log.file.path: /var/log/ccure.csv`

Is there a way to create an index based on one of these criteria?

Secondly, how do you go about creating a parser for that index? I don’t know if that’s actually the correct approach so please let me know if there’s a “right” way to do it.

For example:

`@timestamp: 2025-08-19 16:04:00.000`  
`ccure.name.last: Smith`  
`ccure.name.first: John`  
`ccure.door: BREAKROOM HALLWAY`  
`ccure.action: CardAdmitted`

Again, I’m just learning this so please forgive me if I’m doing this incorrectly but I’m eager to learn how to achieve this correctly.

Thanks!

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [August 21, 2025, 3:26am UTC](https://discuss.elastic.co/t/newbie-question-can-you-create-a-new-index-and-parser-for-a-log-that-has-a-certain-string/381138/2 "2025-08-21T03:26:04Z")

</div>

Hello @meatwad

Could you please share as to how you are indexing this data into elasticsearch? via filebeat/logstash/elastic-agent based on this your query could be answered about creating the index name based on the log.file.path =\> ccure

Thanks!!

---

<div class="post-metadata">

**Author:** ![meatwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/meatwad/32/36031_2.png) [@meatwad](https://discuss.elastic.co/u/meatwad)\
**Post date:** [August 21, 2025, 9:28pm UTC](https://discuss.elastic.co/t/newbie-question-can-you-create-a-new-index-and-parser-for-a-log-that-has-a-certain-string/381138/3 "2025-08-21T21:28:38Z")

</div>

Hi there and thank you very much for the reply.

The CCURE logs are being written to S3, synced to a syslog server, and ingesting via the elastic-agent that’s managed with Fleet and the “System” integration:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba7d9e5c37e03f274b30d6b830788c7e080c4063.png)

Thank you again!