# Create custom index while sending logs from filebeat to elasticsearch

**URL:** <https://discuss.elastic.co/t/create-custom-index-while-sending-logs-from-filebeat-to-elasticsearch/319747>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 24, 2022, 11:24am UTC](https://discuss.elastic.co/t/create-custom-index-while-sending-logs-from-filebeat-to-elasticsearch/319747 "2022-11-24T11:24:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [November 24, 2022, 11:24am UTC](https://discuss.elastic.co/t/create-custom-index-while-sending-logs-from-filebeat-to-elasticsearch/319747/1 "2022-11-24T11:24:08Z")

</div>

Hi i've setup filebeat(7.17.7) to send logs to elasticsearch(8.5.1)  
The logs are getting shipped but to the default index that is filebeat 7.17  
Here is my filebeat.yml

```auto
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["43.204.205.20:9200"]

  output.elasticsearch.index: "nexus-%{[agent.version]}-%{+yyyy.MM.dd}"
    setup.template:
     name: 'nexus-%{[agent.version]}-%{+yyyy.MM.dd}'
     pattern: 'nexus-%{[agent.version]}-%{+yyyy.MM.dd}'
     enabled: false
  username: "elastic"
  password: "minutus"
  setup.ilm.enabled: false
  setup.template.overwrite: true

```

If i add  
#index: "nexus-%{[agent.version]}-%{+yyyy.MM.dd}"  
filebeat service fails instead of above config giving error attempted to start quickly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 22, 2022, 1:24pm UTC](https://discuss.elastic.co/t/create-custom-index-while-sending-logs-from-filebeat-to-elasticsearch/319747/2 "2022-12-22T13:24:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.