title: Way to populate Logstash output variable without getting it from an Input?
body: <p>Is there another way to tell Logstash to supply a value to an <strong>output</strong> variable without pulling it from a Logstash input?  For example, in my case I'd like to create an Elasticsearch index based on a performance run ID (which I'd do from an external script) and then have Logstash send to that. For now I was thinking of creating a tcp input just for receiving perf run info and then have a filter to match on the run id. Seems like a convoluted way to do this though. For example: </p>
  
  <pre><code>input {
      tcp {
          type =&gt; "perfinfo"
          port =&gt; 8888
      }
  }
  
  if [type] == "perfinfo" {
      do some matching to extract the id
  }
  
  output {
      elasticsearch { 
          cluster =&gt; "mycluster" 
          manage_template =&gt; false 
          index =&gt; "%{id}-perftest" 
      }
  }
  </code></pre>
  
  <p>I'm not sure if setting <strong>manage_template</strong> to false would actually be necessary. I've read that it is. </p>
  
  <p><strong>Update</strong></p>
  
  <p>Thanks Nirdesh for that. Using Ruby might be very handy.</p>
  
  <p>While I was waiting I tried using a grok filter like so:</p>
  
  <pre><code>grok {
    match =&gt; { "message" =&gt; "%{WORD:perftype}-%{POSINT:perfid}" }
  }
  </code></pre>
  
  <p>Which produced this stdout during debugging:</p>
  
  <pre><code>{
     "message" =&gt; "awperf-14",
    "@version" =&gt; "1",
  "@timestamp" =&gt; "2014-10-17T20:01:19.758Z",
        "host" =&gt; "0:0:0:0:0:0:0:1:33361",
        "type" =&gt; "perfinfo",
    "perftype" =&gt; "awperf",
      "perfid" =&gt; "14"
  }
  </code></pre>
  
  <p>Which I tried creating an index based on this like so:</p>
  
  <pre><code>index =&gt; "%{perftype}-%{perfid}"
  </code></pre>
  
  <p>So when I passed 'awperf-14' to the input, I ended up creating these indexes</p>
  
  <p>%{perftype}-%{perfid}</p>
  
  <p>awperf-14</p>
  
  <p>Which is not what I was expecting. Also, it's the %{perftype}-%{perfid} index that starts to be populated, not awperf-14, the one I actually wanted.</p>