# Can't create indices

**URL:** <https://discuss.elastic.co/t/cant-create-indices/174492>\
**Category:** Logstash\
**Created:** [March 29, 2019, 8:14am UTC](https://discuss.elastic.co/t/cant-create-indices/174492 "2019-03-29T08:14:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![HuanW](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/huanw/32/43060_2.png) [@HuanW](https://discuss.elastic.co/u/HuanW)\
**Post date:** [March 29, 2019, 8:14am UTC](https://discuss.elastic.co/t/cant-create-indices/174492/1 "2019-03-29T08:14:31Z")

</div>

Hi,  
The question is one of my input setting doesn't work.  
The way I check is I go to Kibana and check on the index management page, and I didn't see the indice.

The input that have problem is type=\>"anotherApplog"  
config file as below:

```
input {
file {type=>"iislog" path=>"\\testNumber8.testPath/iislog/*/*.log" start_position=>"beginning"}
file {type=>"applog" path=>"\\testNumber05.testPath/log/*/*-error.log" start_position=>"beginning"}
file {type=>"anotherApplog" path=>"\\testNumber05.testPath/log/projectName/*-debug.log" start_position=>"beginning"}
}

filter {
	if [type] == "iislog" {
		grok {
			match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:s-sitename} %{IPORHOST:computername} %{IP:s-ip} %{WORD:cs_method} %{URIPATH:cs_uri_stem} %{NOTSPACE:cs_uri_query} %{NUMBER:s_port} %{NOTSPACE:cs_username} %{IPORHOST:c_ip} %{NOTSPACE:cs_version} %{NOTSPACE:cs_user_agent} %{NOTSPACE:cs_Cookie} (?<cs_Referer>(?:https?:\/\/)?(?:[^@\/\n]+@)?(?:www\.)?(?<cs_Referer_domain>[^:\/?\n]+).+|-) %{NOTSPACE:cs_host} %{NUMBER:sc_status} %{NUMBER:sc_substatus} %{NUMBER:sc_win32_status} %{NUMBER:sc_bytes} %{NUMBER:cs_bytes} %{NUMBER:time_taken}"]
		}
	}
	else if [type] == "anotherApplog" {
		multiline {
			negate => true
			pattern => "^\[DEBUG\]"	
			what => "previous"
		}
		grok {
			//do something
		}
	}
	else{
		multiline {
			negate => true
			pattern => "^\[ERROR\]"	
			what => "previous"
		}
		grok {
			match => ["message", "\[%{LOGLEVEL:log_level}\ ?\] %{TIMESTAMP_ISO8601:server_time} \- %{GREEDYDATA:app_log}"]
		}
	}
	
	grok {
		match => { path => "%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"}
	}	
	
	if [type] == "iislog" {
		if [message] =~ "^#" {
			drop {}
		}
		
		date {
			match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"]
			timezone => "Etc/UTC"
			target => "@timestamp"
		}	
	
		geoip {
			source => "clientip"
			target => "geoip"
			database => "F:/GeoIP2-City.mmdb"
			add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
			add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
		}
	
		useragent {
			source=> "useragent"
			prefix=> "browser"
		}
		
        mutate {
            convert => ["[time_taken]","integer" ]
            convert => ["[sc_bytes]", "integer" ]
            convert => ["[cs_bytes]", "integer" ]
            convert => ["[geoip][location]", "float" ]
        }
		
		mutate
		{
			remove_field => ["message"]
		}
	}
	
	date {
      match => ["server_time","YYYY-MM-dd HH:mm:ss,SSS"]
      timezone => "Etc/GMT+4"
      target => "@timestamp"
    }
}

output {
	elasticsearch {
		hosts => ["localhost:9200"]
		index => "%{type}-%{+YYYY.MM.dd}"
	}
}
```

---

<div class="post-metadata">

**Author:** ![HuanW](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/huanw/32/43060_2.png) [@HuanW](https://discuss.elastic.co/u/HuanW)\
**Post date:** [April 19, 2019, 8:57am UTC](https://discuss.elastic.co/t/cant-create-indices/174492/2 "2019-04-19T08:57:16Z")

</div>

Solved  
The root cause is because the type can not have capital

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2019, 9:05am UTC](https://discuss.elastic.co/t/cant-create-indices/174492/3 "2019-05-17T09:05:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.