# ELK 7.12 - ILM Rollover - After rollover data keeps being writing old index 000001

**URL:** <https://discuss.elastic.co/t/elk-7-12-ilm-rollover-after-rollover-data-keeps-being-writing-old-index-000001/271417>\
**Category:** Kibana\
**Tags:** ilm-index-lifecycle-management\
**Created:** [April 27, 2021, 4:48pm UTC](https://discuss.elastic.co/t/elk-7-12-ilm-rollover-after-rollover-data-keeps-being-writing-old-index-000001/271417 "2021-04-27T16:48:14Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 27, 2021, 8:58pm UTC](https://discuss.elastic.co/t/elk-7-12-ilm-rollover-after-rollover-data-keeps-being-writing-old-index-000001/271417/4 "2021-04-27T20:58:06Z")

</div>

if you want to pass through  
beats-\>logstash-\>es  
and have all the templates, ILM, pipelines etc work your logstash conf should look like this.  
Configure the correct Elasticsearch endpoint and creads.  
Do not change the other settings, ILM and Pipelines etc

```
################################################
# beats->logstash->es default config.
################################################
input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      user => "elastic"
      password => "secret"
    }
  }
}

```

The general process for this is 🙂 if you want to use all the beats functionality but pass through logstash.

1. You may need to clean up.
2. Configure your beats / modules how you want.
3. Point the beats output to elasticsearch and run  
`packetbeat setup -e`
4. Then go back into packetbeat.yml and configure the output to logstash, comment out the elasticsearch output.
5. Start logstash with the conf above
6. Start packetbeat

When you name the index with the `-00001` etc it will never write to the new index etc.

---

_[View the full topic](https://discuss.elastic.co/t/elk-7-12-ilm-rollover-after-rollover-data-keeps-being-writing-old-index-000001/271417)._