# 2 indices
**URL:** https://discuss.elastic.co/t/2-indices/142298
**Category:** Logstash
**Created:** [July 31, 2018, 7:42am UTC](https://discuss.elastic.co/t/2-indices/142298 "2018-07-31T07:42:19Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@fooc](https://discuss.elastic.co/u/fooc)
#### Post date: [July 31, 2018, 7:42am UTC](https://discuss.elastic.co/t/2-indices/142298/1 "2018-07-31T07:42:19Z")
Hello,
In my new setup i created a beat.conf so i can receive my data from a windows machine with winlogbeat installed and set the output to elastic.
When i create an index i can choose betwen logstash and winlogbeat and in monitoring i'm seeing 2 indices with the same size.
I think i'm collecting and storing the data twice, what am i doing wrong?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 31, 2018, 8:25am UTC](https://discuss.elastic.co/t/2-indices/142298/2 "2018-07-31T08:25:40Z")
You will probably need to share your beat and Logstash config, minus comments 🙂
---
### Author:  [@fooc](https://discuss.elastic.co/u/fooc)
#### Post date: [July 31, 2018, 9:33am UTC](https://discuss.elastic.co/t/2-indices/142298/3 "2018-07-31T09:33:10Z")
input {
beats {
port =\> 5044
}
}
output {
elasticsearch {
hosts =\> ["[http://10.0.0.46:9200](http://10.0.0.46:9200)"]
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
---
### Author:  [@fooc](https://discuss.elastic.co/u/fooc)
#### Post date: [July 31, 2018, 9:36am UTC](https://discuss.elastic.co/t/2-indices/142298/4 "2018-07-31T09:36:32Z")
settings modified in logstash.yml:
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
http.host: "10.0.0.46"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
---
### Author:  [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)
#### Post date: [July 31, 2018, 9:43am UTC](https://discuss.elastic.co/t/2-indices/142298/5 "2018-07-31T09:43:58Z")
Where is your winlogbeat output?
Normally you have to comment the elasticsearch output and uncomment the logstash output.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 31, 2018, 9:44am UTC](https://discuss.elastic.co/t/2-indices/142298/6 "2018-07-31T09:44:16Z")
Are you running Logstash as a service? Do you by any chance have more than one file containing an elasticsearch output in the config directory? Be aware that Logstash will concatenate all files into a single logical pipeline, which means that data from all inputs will go to all outputs unless you control the flow using conditionals.
---
### Author:  [@fooc](https://discuss.elastic.co/u/fooc)
#### Post date: [July 31, 2018, 10:12am UTC](https://discuss.elastic.co/t/2-indices/142298/7 "2018-07-31T10:12:44Z")
Ah yes i found it, i had another config file for syslog, i did not use it yet so i deleted it i now its fine.
thanx for your input
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2018, 10:12am UTC](https://discuss.elastic.co/t/2-indices/142298/8 "2018-08-28T10:12:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.