# Beats and index naming

**URL:** <https://discuss.elastic.co/t/beats-and-index-naming/195073>\
**Category:** Beats\
**Created:** [August 13, 2019, 6:08pm UTC](https://discuss.elastic.co/t/beats-and-index-naming/195073 "2019-08-13T18:08:56Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 17, 2019, 10:55pm UTC](https://discuss.elastic.co/t/beats-and-index-naming/195073/21 "2019-08-17T22:55:22Z")

</div>

> [@Marcell0e](#):
>
> PUT /winlogbeat-7.3.0-2019.33-1 { "aliases": { "winlogbeat-": { "is\_write\_index": true } } }

Per [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/getting-started-index-lifecycle-management.html) "index.lifecycle.rollover\_alias" needs to match the alias in the index.

Also I think you need a few more digits for the index name or it will break after 9

```
PUT /winlogbeat-7.3.0-2019.33-0001
{
  "aliases": {
    "winlogbeat-7.3.0": {
      "is_write_index": true
    }
  }
}

```

I usually start these adventures with all the defaults and get them running, understand how it all, then start to modify i.e. I would have started with all the defaults (daily) got it working, understood then move onto altering it... just my approach ... and yes there are a lot of similar settings / config going on.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 19, 2019, 1:40am UTC](https://discuss.elastic.co/t/beats-and-index-naming/195073/22 "2019-08-19T01:40:56Z")

</div>

This thread may be of help as well

> [@Elasticsearch custom ILM](https://discuss.elastic.co/t/elasticsearch-custom-ilm/195659):
>
> Hello, I am attempting to setup custom indexes for winlogbeat via logstash using ILM settings in the elasticsearch output. I would like to use the default template for winlogbeat (winlogbeat-7.3.0) but have different custom indexes for each organization. The purpose of the separate indexes is to have users be able to login to the kibana instance with roles that can only view their particular indexes for winlogbeat. I would like to use the following base structure for the indexes winlogbeat-…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2019, 3:41am UTC](https://discuss.elastic.co/t/beats-and-index-naming/195073/23 "2019-09-16T03:41:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/beats-and-index-naming/195073.md?page=1)