use field in index name for elasticsearch plugin logstash

Question

I am trying to have elasticsearch index based on field so I can get an index for each source (allowing for secure access to each index).

I tried something along the lines of

output {
    stdout { codec => rubydebug }
    elasticsearch {
       index => [SERVER]"-%{+YYYY.MM.dd}"
    }
}

as well as

output {
    stdout { codec => rubydebug }
    elasticsearch{
       index => "[SERVER]-%{+YYYY.MM.dd}"
    }
}

and neither work : first errors, second tries to create the index with [SERVER] in it then errors due to uppercase, this might not be supported as I can't find it anywhere in the docs, but I was wondering if anyone has gotten something like this functional for their own ELK stacks?

Answer 1

The right syntax for this is "%{SERVER}-%{+YYYY.MM.dd}"

According to the documentation :

[The index to write] can be dynamic using the %{foo} syntax.