# Unable to create index based on POD names with provided prefix

**URL:** <https://discuss.elastic.co/t/unable-to-create-index-based-on-pod-names-with-provided-prefix/362196>\
**Category:** Elasticsearch\
**Created:** [June 28, 2024, 9:18am UTC](https://discuss.elastic.co/t/unable-to-create-index-based-on-pod-names-with-provided-prefix/362196 "2024-06-28T09:18:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mandar\_Pimplapure](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mandar_pimplapure/32/121792_2.png) [@Mandar\_Pimplapure](https://discuss.elastic.co/u/Mandar_Pimplapure)\
**Post date:** [June 28, 2024, 9:18am UTC](https://discuss.elastic.co/t/unable-to-create-index-based-on-pod-names-with-provided-prefix/362196/1 "2024-06-28T09:18:55Z")

</div>

We used multi\_format format to read logs but then indexes are not created properly with pod names. Here it seems unable to read pod\_name using below prefix :

```auto
logstash_prefix "{ENV['K8S_NODE_NAME']}-${record['kubernetes']['pod_name']}"

```

Indexes are created as below :  
efk-stack-${record['kubernetes']['pod\_name']}-2024.06.28

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 28, 2024, 9:39am UTC](https://discuss.elastic.co/t/unable-to-create-index-based-on-pod-names-with-provided-prefix/362196/2 "2024-06-28T09:39:10Z")

</div>

Creating an index per pod per day sounds like a very bad idea as it means you risk having a lot of very small shards and indices, which can be very inefficient and cause problems. I would recommend you read [this part of the docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/size-your-shards.html) and follow the recommendations provided there.