Skip to main content
Solved

How do I pass the index field from the source to the S3 destination file name?

  • March 11, 2025
  • 1 reply
  • 2 views

Hello, I’m trying to creation a S3 destination and trying to figure out how I can add index value to the file name.  How do I pass the index field from the source to the S3 destination file name?

Best answer by Jon Rust

https://docs.cribl.io/stream/usecase-s3-better-practices

https://docs.cribl.io/stream/destinations-s3

the partition expression is where you want to look

`${C.Time.strftime(_time ? _time : Date.now() / 1000, '%Y/%m/%d')}/${index ? index : 'no_index'}/${host ? host : 'no_host'}/${sourcetype ? sourcetype : 'no_sourcetype'}`

Hit the popout to edit while seeing a preview of what it will look like:

388_b02477e2530a42cd963539cf6011a1b3.png

1 reply

Jon Rust
Forum|alt.badge.img
  • Employee
  • Answer
  • March 11, 2025

https://docs.cribl.io/stream/usecase-s3-better-practices

https://docs.cribl.io/stream/destinations-s3

the partition expression is where you want to look

`${C.Time.strftime(_time ? _time : Date.now() / 1000, '%Y/%m/%d')}/${index ? index : 'no_index'}/${host ? host : 'no_host'}/${sourcetype ? sourcetype : 'no_sourcetype'}`

Hit the popout to edit while seeing a preview of what it will look like:

388_b02477e2530a42cd963539cf6011a1b3.png