# Elastic agent can't reroute docs to a different index
**URL:** https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651
**Category:** Elastic Agent
**Tags:** integrations
**Created:** [January 23, 2024, 5:42pm UTC](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651 "2024-01-23T17:42:20Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@lizozom](https://discuss.elastic.co/u/lizozom)
#### Post date: [January 23, 2024, 5:42pm UTC](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651/1 "2024-01-23T17:42:20Z")
I have fleet agents with a custom logs.
I want to route some of the logs to a different index.
I created the index `task-logs` and in the integration, I defined an `reroute` ingest pipeline. However,the documents don't reach the index, and instead I get an error.
This is the error I see in the main `logs-*` index:
I suspect this might be related to the permissions error mentioned in the [docs](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/reroute-processor.html).
How do I (a) prove it and (b) fix it?
Thank you!
---
### Author:  [@lizozom](https://discuss.elastic.co/u/lizozom)
#### Post date: [January 23, 2024, 6:03pm UTC](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651/2 "2024-01-23T18:03:29Z")
I instead used the `dataset` option to receive the tasks.
It created an index (?) called logs-taks for me.
Is this the correct way to go?
---
### Author:  [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [January 30, 2024, 1:59pm UTC](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651/3 "2024-01-30T13:59:15Z")
Hi,
Yes, using the `dataset` option is a common way to route different types of logs to different indices in Elastic Stack.
Regards
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [January 30, 2024, 3:37pm UTC](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651/4 "2024-01-30T15:37:19Z")
Hi @lizozom
Did you try to simply filling in static fields for the namespace and dataset?
I don't think just `logs-task` is proper syntax I think you need all three parts
`logs-tasks-generic`
or something like that
---
### Author:  [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [January 30, 2024, 4:41pm UTC](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651/5 "2024-01-30T16:41:04Z")
HI,
from this article:
The Elastic data stream naming scheme is made for time series data and consists of splitting datasets into different data streams using the following naming convention.
- **type** : Generic type describing the data
- **dataset** : Describes the data ingested and its structure
- **namespace** : User-configurable arbitrary grouping
These three parts are combined by a “-” and result in data streams like `logs-nginx.access-production`. In all three parts, the “-” character is not allowed. This means all data streams are named in the following way:
**{type}-{dataset}-{namespace}**
For both dataset and namespace there is a default value, which is `dataset=generic` and `namespace=default`. In the case of Elastic Agent, if a user just starts to ingest a log file, the data ends up in `logs-generic-default`.\*\*
\*\*
[An introduction to the Elastic data stream naming scheme | Elastic Blog](https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme)
Regards
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 27, 2024, 4:41pm UTC](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651/6 "2024-02-27T16:41:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.