Self-name index?

Elastic Stack Logstash
1

Hi Currently my index are named by date (from @timestamp i suspect). How can i self-name them so that i can only analyze certain portion of yesterday's parsed data (not searchable from ES UI)? In another word, how can i group the data i intend to use in one index?

My current index:
Indices
.kibana
.marvel-es-1-2016.08.23
.marvel-es-1-2016.08.24
.marvel-es-1-2016.08.25
.marvel-es-1-2016.08.26
.marvel-es-1-2016.08.27
.marvel-es-1-2016.08.29
.marvel-es-data-1
data
logstash-2015.02.01
logstash-2015.12.31
logstash-2016.01.01
logstash-2016.02.01
logstash-2016.03.01
logstash-2016.08.23
logstash-2016.08.24
logstash-2016.08.25
logstash-2016.08.26
logstash-2016.08.29
my_index

2

That depends on how you put the indexes into Elasticsearch. If you are doing so using Logstash I suspect you'll have to reconfigure that.

3

Hi Yes i use logstash. Where should i reconfigure? in conf file?

4

Yes. I expect you'll have more luck asking o. The logstash forum. Sorry I
couldn't be of more help!

5

Hi Allie,

I moved this to the Logstash forum

Best of luck getting it all working!

Alex

6

Modify your elasticsearch output's index option to contain the desired index name.

7

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.