# Filebeat not setting index name even though configured

**URL:** https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793
**Category:** Beats
**Created:** [June 23, 2016, 3:26pm UTC](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793 "2016-06-23T15:26:29Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)
#### Post date: [June 23, 2016, 3:26pm UTC](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793/1 "2016-06-23T15:26:29Z")

</div>

In filebeat.yml i have set:  
index: filebeat-app

yet in the json output there is nothing for index, and it still receives teh default logstash-$date index when inserted into elasticsearch.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [June 23, 2016, 6:15pm UTC](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793/2 "2016-06-23T18:15:39Z")

</div>

did you [follow the docs](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html). At which place did you set the index? Can you share your config?

---

<div class="post-metadata">

### Author: ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)
#### Post date: [June 23, 2016, 6:21pm UTC](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793/3 "2016-06-23T18:21:24Z")

</div>

```auto
output:
  logstash:
    hosts: ["logstash01:5044", "logstash02:5044", "logstash03:5044"]

    # Number of workers per Logstash host.
    worker: 16

    # Set gzip compression level.
    #compression_level: 3

    # configure logstash plugin to loadbalance events between the logstash instances
    loadbalance: true

    # configure index prefix name
    index: filebeat-app

```

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 23, 2016, 10:56pm UTC](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793/4 "2016-06-23T22:56:41Z")

</div>

I wouldn't use a monolithic index, use time based ones.  
Otherwise how do you manage retention of old records?

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [June 24, 2016, 11:39am UTC](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793/5 "2016-06-24T11:39:29Z")

</div>

Did you [check the docs](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html).

The index is exposed under `[@metadata][beat]` in logstash.

Sample elasticsearch output to use index name from beats:

```auto
output {
  elasticsearch {
    host => "localhost"
    port => "9200"
    protocol => "http"
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 14, 2016, 3:26pm UTC](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793/6 "2016-07-14T15:26:38Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.