# WatcherのIndex Actionで、Index名を可変にする方法がないか

**URL:** <https://discuss.elastic.co/t/watcher-index-action-index/183483>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 30, 2019, 7:41am UTC](https://discuss.elastic.co/t/watcher-index-action-index/183483 "2019-05-30T07:41:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![5f750bbb360aba6ced5f](https://avatars.discourse-cdn.com/v4/letter/5/f1d935/32.png) [@5f750bbb360aba6ced5f](https://discuss.elastic.co/u/5f750bbb360aba6ced5f)\
**Post date:** [May 30, 2019, 7:41am UTC](https://discuss.elastic.co/t/watcher-index-action-index/183483/1 "2019-05-30T07:41:08Z")

</div>

Watcherの実行時にAction句でIndexを作成しているのですが、  
この時、作成される日付に応じて、Index名を変える（＝Watcherが実行されるたびに新しいIndexを作成する）ことができないでしょうか。

具体的にやりたいこととしては、  
毎月月初にWatcherを実行し、実行日の前月の年月がIndex名の末尾に付記されるようにしたいです。  
_例: 6月1日にWatcherが実行され、watcher\_201905というIndexが作成される_

> {  
> "trigger": {  
> "schedule": {  
> "monthly": {"on":1,"at":"midnight"} //毎月月初に実行  
> }  
> },  
> "input": {  
> ・・・  
> },  
> "condition": {  
> ・・・  
> },  
> "actions": {  
> "index\_payload": {  
> "index": {  
> "index": "watcher", //Indexの末尾に、”YYYYMM”という形で、実行日の前月の年月を付記したい  
> "doc\_type": "doc"  
> }  
> ...  
> }

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 31, 2019, 10:42am UTC](https://discuss.elastic.co/t/watcher-index-action-index/183483/2 "2019-05-31T10:42:41Z")

</div>

Hey,

see [https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html)

You can use date math in index names, and just always go one month back with, see this example from the above link

```auto
<logstash-{now/M-1M{yyyy.MM}}>

```

--Alex

---

<div class="post-metadata">

**Author:** ![5f750bbb360aba6ced5f](https://avatars.discourse-cdn.com/v4/letter/5/f1d935/32.png) [@5f750bbb360aba6ced5f](https://discuss.elastic.co/u/5f750bbb360aba6ced5f)\
**Post date:** [June 3, 2019, 7:59am UTC](https://discuss.elastic.co/t/watcher-index-action-index/183483/3 "2019-06-03T07:59:17Z")

</div>

Hello,

Thank you for your replay.  
Sorry that my description was not enough. The above code I posted is not for config file (like logstash.conf) or the part of API but the script for the watcher. So in my understand, it cannot contain such characters.  
In case, I executed and I got following message.

> message": "[watch\_{now/M-1M{yyyy.MM}}] InvalidIndexNameException[Invalid index name [watch\_{now/M-1M{yyyy.MM}}], must not contain the following characters [, ", \*, \, \<, |, ,, \>, /, ?]]",

Best regards.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 3, 2019, 12:15pm UTC](https://discuss.elastic.co/t/watcher-index-action-index/183483/4 "2019-06-03T12:15:41Z")

</div>

this is supposed to be the index name so it can go straight into your watch. Judging from the error message the `<>` brackets are missing. Can you share the whole watch again including your changes, so one can try to reproduce locally? Thanks!

---

<div class="post-metadata">

**Author:** ![5f750bbb360aba6ced5f](https://avatars.discourse-cdn.com/v4/letter/5/f1d935/32.png) [@5f750bbb360aba6ced5f](https://discuss.elastic.co/u/5f750bbb360aba6ced5f)\
**Post date:** [June 4, 2019, 8:00am UTC](https://discuss.elastic.co/t/watcher-index-action-index/183483/5 "2019-06-04T08:00:45Z")

</div>

Finally worked! As you told me, the problem was just lacking of `<>`.  
Thank you for your swift and helpful advice.

My latest code is like below.

```
"actions" : {
   "index_payload" : {
       "transform" : { ... },
       "index" : {
            "index" : "<logstash-{now/M-1M{yyyy.MM}}>",
            "doc_type" : "doc"
        }
    }
 }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 2, 2019, 8:00am UTC](https://discuss.elastic.co/t/watcher-index-action-index/183483/6 "2019-07-02T08:00:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.