# Filebeat output indices behavior

**URL:** <https://discuss.elastic.co/t/filebeat-output-indices-behavior/202934>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 10, 2019, 2:40am UTC](https://discuss.elastic.co/t/filebeat-output-indices-behavior/202934 "2019-10-10T02:40:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ninjasloth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ninjasloth/32/55659_2.png) [@ninjasloth](https://discuss.elastic.co/u/ninjasloth)\
**Post date:** [October 10, 2019, 2:40am UTC](https://discuss.elastic.co/t/filebeat-output-indices-behavior/202934/1 "2019-10-10T02:40:58Z")

</div>

Currently I am using a custom index pattern via indices when filters. This works as expected. However anything not matching the rule ends up being sent to the default filebeat- index.  
As per the docs this makes sense:

> If the `indices` setting is missing or no rule matches, the [`index`](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es) setting is used.

I have a config that looks like this (watered down).

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /opt/data/application/logs/*.log
  json.message_key: message
  json.keys_under_root: true
  fields:
    logger: "application"

output.elasticsearch:
  hosts:
    - "elasticsearch:9200"
  protocol: "https"
  ssl.verification_mode: none
  username: "foo"
  password: "bar"
  indices:
    - index: "application-%{[agent.version]}-%{+yyyy.MM.dd}"
      when.and:
        - equals:
            fields.logger: "application"
        - equals:
            app.value: 1

```

When using the output as above, if it doesn't match the index pattern "when" statement it just defaults to the default filebeat index.  
Is there a way to disable the default index completely or should I be using Input filter processors instead to drop unwanted events?  
I'm unsure the best approach to this.  
Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\
**Post date:** [October 10, 2019, 6:25pm UTC](https://discuss.elastic.co/t/filebeat-output-indices-behavior/202934/2 "2019-10-10T18:25:16Z")

</div>

@ninjasloth I changed the category for this question to Beats/Filebeat. They will be able to provide better support for this question and get you all sorted out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2019, 6:25pm UTC](https://discuss.elastic.co/t/filebeat-output-indices-behavior/202934/3 "2019-11-07T18:25:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.