# Sincedb Creation with %{type} syntaxe

**URL:** <https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525>\
**Category:** Logstash\
**Created:** [March 12, 2018, 10:30am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525 "2018-03-12T10:30:18Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Post date:** [March 12, 2018, 10:30am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/1 "2018-03-12T10:30:19Z")

</div>

Hi,

I would like to be able to create different sincedb for each logstash conf file as below by inserting %{mytype} in the sincedb\_path string.

```
input {
   file {
        type => "appname"
        path => "/path/to/catalina.out"
        sincedb_path => "/usr/share/logstash/sincedb/input.sincedb.%{type}"
        codec =>
           multiline {
               pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\s*%{HOUR}:?%{MINUTE}(?::?%{SECOND})"
               negate => true
               what => "previous"
               charset => "ASCII"
          }
   }
}

```

But the filename isn't created as I want expected

-rw-r--r-- 1 logstash logstash 24 mars 12 10:53 **input.sincedb.%{type}**

I would like the filename look like

-rw-r--r-- 1 logstash logstash 24 mars 12 10:53 **input.sincedb.appname**

Any help would be appreciated.  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 12, 2018, 10:48am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/2 "2018-03-12T10:48:52Z")

</div>

You can't make `%{fieldname}` references inside the input section.

---

<div class="post-metadata">

**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Post date:** [March 12, 2018, 11:05am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/3 "2018-03-12T11:05:54Z")

</div>

Does sincedb act intelligently and recognize each conf file ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 12, 2018, 11:28am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/4 "2018-03-12T11:28:59Z")

</div>

What do you mean?

---

<div class="post-metadata">

**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Post date:** [March 12, 2018, 11:32am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/5 "2018-03-12T11:32:38Z")

</div>

I have several conf in which input file read different file.  
Does sincedb could differentiate the last position of each file where logstash has read ?  
Regards

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 12, 2018, 9:42pm UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/6 "2018-03-12T21:42:21Z")

</div>

If you don't specify `sincedb_path` at all Logstash will, as documented, pick a sincedb path based on the filename pattern. That should be fine in your case. If you want to set the sincedb path yourself that's fine too but then it's up to you to make sure the sincedb path for each file input is unique.

---

<div class="post-metadata">

**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Post date:** [March 14, 2018, 9:06am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/7 "2018-03-14T09:06:23Z")

</div>

Hi Magnus,

As part of my logs file are from Tomcat, they have the same name like **catalina.out**.  
Could it be confusing for Logstash ?  
Regards

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 14, 2018, 9:40am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/8 "2018-03-14T09:40:53Z")

</div>

No, of course not.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2018, 9:40am UTC](https://discuss.elastic.co/t/sincedb-creation-with-type-syntaxe/123525/9 "2018-04-11T09:40:57Z")

</div>

Closed on April 11, 2018, 9:40am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.