# Feed data into the newly created index

**URL:** <https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822>\
**Category:** Elasticsearch\
**Created:** [April 26, 2020, 8:09am UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822 "2020-04-26T08:09:13Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\
**Post date:** [April 26, 2020, 8:09am UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/1 "2020-04-26T08:09:13Z")

</div>

I am new to ELK. I have created a new index myself. But the data is still feeding into the old index. How do i switch it to new index?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 26, 2020, 9:14am UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/2 "2020-04-26T09:14:56Z")

</div>

What are you using to send the data?

---

<div class="post-metadata">

**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\
**Post date:** [April 26, 2020, 10:24am UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/3 "2020-04-26T10:24:38Z")

</div>

filebeat to logstash to elastichseach and kibana

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 26, 2020, 12:01pm UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/4 "2020-04-26T12:01:06Z")

</div>

What is the logstash pipeline configuration ?

---

<div class="post-metadata">

**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\
**Post date:** [April 26, 2020, 3:23pm UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/5 "2020-04-26T15:23:05Z")

</div>

This is the output

```auto
output {
if [fields][log_type] == "networkInfo"{
        elasticsearch {
        hosts => ["localhost:9200"]
        manage_template => false
        index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        }
} else if [fields][log_type] == "websocket" {
        elasticsearch {
        hosts => ["localhost:9200"]
        manage_template => false
        index => "mdp-huobi-wslog-delay-%{+YYYY.MM.dd}"
        }
}

if "_dateparsefailure" in [tags] {
    file {
      path => "/var/log/logstash/dateparsefailure.log"
      codec => json_lines
    }
}

file {
  path => "/var/log/logstash/output.log"
  codec => rubydebug
}

# stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 26, 2020, 3:44pm UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/6 "2020-04-26T15:44:12Z")

</div>

> But the data is still feeding into the old index. How do i switch it to new index?

What is the new index you want to send data to?

---

<div class="post-metadata">

**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\
**Post date:** [April 27, 2020, 2:01am UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/7 "2020-04-27T02:01:03Z")

</div>

The new index i created my self is filebeat-7.6.1-2020.04.26-000001. I wish it will roll over day after day like filebeat-7.6.1-2020.04.27 and filebeat-7.6.1-2020.04.28 and filebeat-7.6.1-2020.04.29 but now it rollover like filebeat-7.6.1-2020.04.26-000001, filebeat-7.6.1-2020.04.26-000002, filebeat-7.6.1-2020.04.26-000003 and no data feed into it.  
Actually, the old index has got the name pattern I wish correctly , it can roll over day by day like filebeat-7.6.1-2020.04.27 and filebeat-7.6.1-2020.04.28 and filebeat-7.6.1-2020.04.29 successfully, but index lifecycle policy doesn't work for it, so I created a new index and tried to apply the index lifecycle policy on it.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 28, 2020, 7:53am UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/8 "2020-04-28T07:53:20Z")

</div>

So does filebeat send data to logstash and then logstash to Elasticsearch?

> `index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"`

This seems to be your index name. So the data are sent to this index I think.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 26, 2020, 7:53am UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822/9 "2020-05-26T07:53:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.