{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/3227","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/3227/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/3227/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/3227/events","html_url":"https://github.com/elastic/beats/issues/3227","id":196702342,"number":3227,"title":"Improve documentation about the indices","user":{"login":"YLombardi","id":9447223,"avatar_url":"https://avatars.githubusercontent.com/u/9447223?v=3","gravatar_id":"","url":"https://api.github.com/users/YLombardi","html_url":"https://github.com/YLombardi","followers_url":"https://api.github.com/users/YLombardi/followers","following_url":"https://api.github.com/users/YLombardi/following{/other_user}","gists_url":"https://api.github.com/users/YLombardi/gists{/gist_id}","starred_url":"https://api.github.com/users/YLombardi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YLombardi/subscriptions","organizations_url":"https://api.github.com/users/YLombardi/orgs","repos_url":"https://api.github.com/users/YLombardi/repos","events_url":"https://api.github.com/users/YLombardi/events{/privacy}","received_events_url":"https://api.github.com/users/YLombardi/received_events","type":"User","site_admin":false},"labels":[{"id":196350690,"url":"https://api.github.com/repos/elastic/beats/labels/docs","name":"docs","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-20T15:33:43Z","updated_at":"2016-12-21T13:01:04Z","closed_at":null,"body":"The documentation about the indices configuration lack information about how to use the Rules settings (condition, mapping, default) : \r\nhttps://www.elastic.co/guide/en/beats/filebeat/5.0/elasticsearch-output.html#_indices\r\n\r\nSome information was added in this topics on Filebeat forum : \r\nhttps://discuss.elastic.co/t/set-indices-based-on-a-field-value/69579\r\n\r\nAdding this information in the documentation will probably help users who want to use this feature."},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/268517424","html_url":"https://github.com/elastic/beats/issues/3227#issuecomment-268517424","issue_url":"https://api.github.com/repos/elastic/beats/issues/3227","id":268517424,"user":{"login":"urso","id":75886,"avatar_url":"https://avatars.githubusercontent.com/u/75886?v=3","gravatar_id":"","url":"https://api.github.com/users/urso","html_url":"https://github.com/urso","followers_url":"https://api.github.com/users/urso/followers","following_url":"https://api.github.com/users/urso/following{/other_user}","gists_url":"https://api.github.com/users/urso/gists{/gist_id}","starred_url":"https://api.github.com/users/urso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/urso/subscriptions","organizations_url":"https://api.github.com/users/urso/orgs","repos_url":"https://api.github.com/users/urso/repos","events_url":"https://api.github.com/users/urso/events{/privacy}","received_events_url":"https://api.github.com/users/urso/received_events","type":"User","site_admin":false},"created_at":"2016-12-21T13:01:04Z","updated_at":"2016-12-21T13:01:04Z","body":"also improve documentation on `index` itself. `index` supports format strings.\r\n\r\nOften we see this pattern in filebeat:\r\n\r\n```\r\nfilebeat.prospectors:\r\n  - ...\r\n    fields.name: X\r\n  - ...\r\n    fields.name: Y\r\n  - ...\r\n    fields.name: Z\r\n\r\noutput.elasticsearch:\r\n  ...\r\n  indices:\r\n    - index: 'X-%{yyyy.MM.dd}'\r\n      when.equal.fields.name: X\r\n    - index: 'Y-%{yyyy.MM.dd}'\r\n      when.equal.fields.name: Y\r\n    - index: 'Z-%{yyyy.MM.dd}'\r\n      when.equal.fields.name: Z\r\n```\r\n\r\nUsing format strings this configuration can be simplified to:\r\n\r\n```\r\nfilebeat.prospectors:\r\n  - ...\r\n    fields.name: X\r\n  - ...\r\n    fields.name: Y\r\n  - ...\r\n    fields.name: Z\r\n\r\noutput.elasticsearch:\r\n  ...\r\n  index: '${[fields.name]}-%{yyyy.MM.dd}'\r\n```"}}
{"actor":{"display_login":"urso"}}