# Problem creating dynamic index from filename (filebeat)

**URL:** https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315
**Category:** Logstash
**Created:** [February 21, 2020, 8:59am UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315 "2020-02-21T08:59:50Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Amine\_Maalfi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amine_maalfi/32/62335_2.png) [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)
#### Post date: [February 21, 2020, 8:59am UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315/1 "2020-02-21T08:59:50Z")

</div>

Hello,

i am trying to create index name same as filename from source but it doesn't seem to work, here's my logstash config file :

```
   input {
      beats{
     port=> 5044
     }
   }

     filter {

     grok {
          match => ["source",".*\\%{GREEDYDATA:app_name}"]
       }
   }

     output {

       stdout {
         codec => rubydebug
          }

         elasticsearch {
          hosts => ["localhost:9200"]
      index => "%{app_name}"
       }
   }
```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 21, 2020, 3:20pm UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315/2 "2020-02-21T15:20:34Z")

</div>

What do you see on stdout and what makes you think it is not working?

---

<div class="post-metadata">

### Author: ![Amine\_Maalfi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amine_maalfi/32/62335_2.png) [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)
#### Post date: [February 21, 2020, 3:21pm UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315/3 "2020-02-21T15:21:23Z")

</div>

the index name i get is exactly %{app\_name}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 21, 2020, 3:32pm UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315/4 "2020-02-21T15:32:14Z")

</div>

OK, so there is no [app\_name] field on the event.

---

<div class="post-metadata">

### Author: ![Amine\_Maalfi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amine_maalfi/32/62335_2.png) [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)
#### Post date: [February 24, 2020, 7:44am UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315/5 "2020-02-24T07:44:47Z")

</div>

there is actually! and i also tried many fields that 100% exist but still it doesn't work

---

<div class="post-metadata">

### Author: ![Amine\_Maalfi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amine_maalfi/32/62335_2.png) [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)
#### Post date: [February 24, 2020, 8:04am UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315/6 "2020-02-24T08:04:47Z")

</div>

here's the pattern test:

![pattern](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d57a5747c0d63958e11a491ab3245d1446529a0.png)

---

<div class="post-metadata">

### Author: ![Amine\_Maalfi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amine_maalfi/32/62335_2.png) [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)
#### Post date: [February 24, 2020, 9:31am UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315/7 "2020-02-24T09:31:12Z")

</div>

I've found the solution, i have used [log][file][path] instead of source and i used mutate to transform it to lowercase, now it's creating indexes based on the source filename.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 23, 2020, 9:31am UTC](https://discuss.elastic.co/t/problem-creating-dynamic-index-from-filename-filebeat/220315/8 "2020-03-23T09:31:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.