Logstash Dynamic Index From Document Field Fails
<p>I still face problems to figure out, how to tell Logstash to send a dynamic index, based on a document field. Furthermore, this Field must be transformed in order to get the "real" index at the very end.
Given, that there is a field "time" (which is a UNIX Timestamp). This Field gets already transformed with a "date" Filter to a DateTime Object for Elastic.
Additionally, it should server as index (YYYYMM). The index should NOT be derived from @Timestamp, which is not touched.</p>

<p>Example:
{...,"time":1453412341,...}</p>

<p>Shall go to the Index: 201601</p>

<p>I use the following Config:</p>

<pre><code>filter {
  date {
    match =&gt; [ "time", "UNIX" ]
    target =&gt; "time"
    timezone =&gt; "Europe/Berlin"
  }
}
output {
    elasticsearch {
        index =&gt; "%{time}%{+YYYYMM}"
        document_type =&gt; "..."
        document_id =&gt; "%{ID}"
        hosts =&gt; "..."
    }
}
</code></pre>

<p>Sadly, its not working. Any idea, how to achieve that?</p>

<p>Thanks a lot!</p>