How do I pass the index field from the source to the S3 destination file name?

Tae Ha

Hello, I’m trying to creation a S3 destination and trying to figure out how I can add index value to the file name.  How do I pass the index field from the source to the S3 destination file name?

Jon Rust

https://docs.cribl.io/stream/usecase-s3-better-practices

https://docs.cribl.io/stream/destinations-s3

the partition expression is where you want to look

`${C.Time.strftime(_time ? _time : Date.now() / 1000, '%Y/%m/%d')}/${index ? index : 'no_index'}/${host ? host : 'no_host'}/${sourcetype ? sourcetype : 'no_sourcetype'}`

Hit the popout to edit while seeing a preview of what it will look like:

Jon Rust

https://docs.cribl.io/stream/usecase-s3-better-practices

https://docs.cribl.io/stream/destinations-s3

the partition expression is where you want to look

`${C.Time.strftime(_time ? _time : Date.now() / 1000, '%Y/%m/%d')}/${index ? index : 'no_index'}/${host ? host : 'no_host'}/${sourcetype ? sourcetype : 'no_sourcetype'}`

Hit the popout to edit while seeing a preview of what it will look like: