# Using custom fields in ILM setup index names

**URL:** <https://discuss.elastic.co/t/using-custom-fields-in-ilm-setup-index-names/191174>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 18, 2019, 10:14am UTC](https://discuss.elastic.co/t/using-custom-fields-in-ilm-setup-index-names/191174 "2019-07-18T10:14:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JamesNotJamez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesnotjamez/32/45736_2.png) [@JamesNotJamez](https://discuss.elastic.co/u/JamesNotJamez)\
**Post date:** [July 18, 2019, 10:14am UTC](https://discuss.elastic.co/t/using-custom-fields-in-ilm-setup-index-names/191174/1 "2019-07-18T10:14:14Z")

</div>

Hi,

I'm creating a custom field, service.name, based on the name of the log file and determined by a processor in the filebeat inputs

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /local/0/seal_logs/*.json
  fields_under_root: true
  processors:
  - dissect:
      tokenizer: '/local/0/seal_logs/seal-client--%{name}.json'
      field: log.file.path
      target_prefix: service
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: message

```

However when I try and use this field name in the setup.ilm fields I'm getting key not found error. Is this possible in the filebeat yml? I'm trying to emulate something I've already achieved with central management, so would have thought you could.

```auto
setup.ilm.rollover_alias: "filebeat-seal-client-%{[service.name]}"
setup.ilm.pattern: "000001"

```

Adding the above to filebeat.yml yields this error

```auto
2019-07-18T11:05:44.009+0100 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://10c1eb224dab461a8d27ca2e4c18790d.dev-eu.elastic.nomura.com:9200)): Connection marked as failed because the onConnect callback failed: error loading template: error creating template instance: key not found

```

Many thanks,  
James

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2019, 10:15am UTC](https://discuss.elastic.co/t/using-custom-fields-in-ilm-setup-index-names/191174/2 "2019-08-15T10:15:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.