Logstash filename as ElasticSearch index

Question

I am using a folder as input:

input {
  file {
    path => "C:/ProjectName/Uploads/*"
    start_position => "beginning"
    sincedb_path => "dev/null"
  }
}

and as output:

output {
  elasticsearch {
    hosts => "localhost"
    index => "manual_index_name" # want filename here
    document_type => "_doc"
  }     
}

I want the index in elasticsearch to be the name of the file being indexed. I've tried variations of this answer with no success as I am not clear on what it is doing: https://stackoverflow.com/a/40156466/6483906

Answer 1

You'll need to use a grok filter to find the last portion of the filename:

filter {
  grok {
     match => ["path", "Uploads/%{GREEDYDATA:index_name}" ]
  }
}

and then just use the portion in your index name index => "%{index_name}"