# Elk-Create New Index-Indices **URL:** \ **Category:** Logstash\ **Created:** [December 15, 2015, 9:13pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280 "2015-12-15T21:13:16Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![ssampati](https://avatars.discourse-cdn.com/v4/letter/s/b38774/32.png) [@ssampati](https://discuss.elastic.co/u/ssampati)\ **Post date:** [December 15, 2015, 9:13pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/1 "2015-12-15T21:13:16Z")
im running elk instance, im trying to create a new indices other than the default logstash\* indice. need help on how to create. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 15, 2015, 9:25pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/2 "2015-12-15T21:25:43Z")
By default indexes are automatically created when documents are posted to them so unless you've changed these defaults it's not clear what the problem is. Do you want to post some events from Logstash to a different index than the rest, or...? ---
**Author:** ![ssampati](https://avatars.discourse-cdn.com/v4/letter/s/b38774/32.png) [@ssampati](https://discuss.elastic.co/u/ssampati)\ **Post date:** [December 15, 2015, 11:51pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/3 "2015-12-15T23:51:52Z")
Yes..i want to create a index for apache logs or syslogs..and then create alerts...for errors. or i want to create a index for group of servers. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 16, 2015, 6:38am UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/4 "2015-12-16T06:38:11Z")
See [http://stackoverflow.com/a/27147688/414355](http://stackoverflow.com/a/27147688/414355) and come back if you have any specific questions. ---
**Author:** ![ssampati](https://avatars.discourse-cdn.com/v4/letter/s/b38774/32.png) [@ssampati](https://discuss.elastic.co/u/ssampati)\ **Post date:** [December 16, 2015, 3:41pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/5 "2015-12-16T15:41:46Z")
instead of script, is it not something we can do on the kibana GUI? using kibana gui can't we create indices and indexes? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 16, 2015, 8:07pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/6 "2015-12-16T20:07:06Z")
_Instead_ of script? In any case you're going to have to configure Logstash to send events to a non-default index. What would be the point of being able to create empty indexes in Kibana? ---
**Author:** ![ssampati](https://avatars.discourse-cdn.com/v4/letter/s/b38774/32.png) [@ssampati](https://discuss.elastic.co/u/ssampati)\ **Post date:** [February 19, 2016, 3:03pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/7 "2016-02-19T15:03:38Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/1/19afbb997ecb906609aac160927081567c150209.png) look at that page. im trying to create a new index with name "syslog" and filter only syslog events vs apache events. now once i crate im not able to figure out how to edit it so that it shows only syslog events. All i see is ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d1528dfc62f582ccdd73c1f8216a93ba6ee659e9.png) any help...greatly appreciated. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 19, 2016, 5:07pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/8 "2016-02-19T17:07:21Z")
Go to the Discovery tab and type in a query that selects the events you're interested in. For example, you'll typically want to use the `type` field to indicate the type of the message. For your syslog messages putting "syslog" there makes good sense, and then your query could become "type:syslog". ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280/9 "2017-07-06T05:10:33Z")