# Filebeat V7.4.1 output.elasticsearch not writing to defined index "logstash"

**URL:** https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444
**Category:** Beats
**Tags:** filebeat
**Created:** [October 28, 2019, 10:59am UTC](https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444 "2019-10-28T10:59:02Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Ritzo](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@Ritzo](https://discuss.elastic.co/u/Ritzo)
#### Post date: [October 28, 2019, 10:59am UTC](https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444/1 "2019-10-28T10:59:03Z")

</div>

Hello

# The goal is to write the filebeat-Logs via the output.elasticsearch into the logstash index. We have done the following entry in the filebeat.yml

setup.template:  
name: "logstash"  
pattern: "logstash-\*"

# output.elasticsearch: hosts: [":9200"] pipeline: "filebeat-7.4.0-%{[fields.pipelinect]}" index: "logstash-%{[agent.version]}-%{+yyyy.MM.dd}"

After restarting the filebeat service we receive the logs not in the logstash-index. We still receive them in the filebeat-7.4.0-Index.

What do we wrong in the configuration.  
Thank for tipps  
Ritzo

---

<div class="post-metadata">

### Author: ![B.M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b.m/32/56771_2.png) [@B.M](https://discuss.elastic.co/u/B.M)
#### Post date: [October 28, 2019, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444/2 "2019-10-28T13:59:04Z")

</div>

Hi could you share your config files

---

<div class="post-metadata">

### Author: ![Ritzo](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@Ritzo](https://discuss.elastic.co/u/Ritzo)
#### Post date: [October 28, 2019, 3:46pm UTC](https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444/3 "2019-10-28T15:46:12Z")

</div>

Hi BM

Thanks for your response. I copied the filebeat.yml into this post

* * *

filebeat.inputs:

- type: log  
enabled: true  
paths:

- type: log  
enabled: true  
paths:

filebeat.config.modules:  
path: ${path.config}/modules.d/\*.yml  
reload.enabled: false

setup.template.settings:  
index.number\_of\_shards: 1

setup.template:  
name: "logstash"  
pattern: "logstash-\*"

output.elasticsearch:  
hosts: ["es.weblocal:9200"]  
pipeline: "filebeat-7.4.1-%{[fields.pipelinect]}"  
index: "logstash-%{[agent.version]}-%{+yyyy.MM.dd}"

processors:

- add\_host\_metadata: ~

logging.selectors: ["\*"]  
logging.level: info

logging.to\_files: true  
logging.files:  
path: /var/log/filebeat74  
name: filebeat\_debug  
keepfiles: 2  
permissions: 0644

xpack.monitoring.enabled: false

* * *

We also enabled the following modules  
filebeat modules enable apache

# and set up the pipelines for them:

filebeat setup --pipelines # result: Loaded Ingest pipelines  
filebeat setup --pipelines --modules system,apache # result: Loaded Ingest pipelines  
filebeat modules list # Enabled: apache

# check config

filebeat test config # config OK  
filebeat test output # parse url OK / connection OK,..... / talk to server OK / version 7.4.1

If you need further infos. Let me know  
Ritzo

---

<div class="post-metadata">

### Author: ![B.M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b.m/32/56771_2.png) [@B.M](https://discuss.elastic.co/u/B.M)
#### Post date: [October 28, 2019, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444/4 "2019-10-28T16:05:12Z")

</div>

In your configuration you are not enabling ILM, but it is activated by default if your Elasticsearch cluster supports it.

Index Lifecycle Management by default creates its own index name.

Try to disable it first: setup.ilm.enabled: false  
[https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html](https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html)

To confirm that it is what's happening, please check your logs for messages from index-management

---

<div class="post-metadata">

### Author: ![Ritzo](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@Ritzo](https://discuss.elastic.co/u/Ritzo)
#### Post date: [October 29, 2019, 11:46am UTC](https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444/5 "2019-10-29T11:46:45Z")

</div>

Cool. It works with this option as excpeted

setup.ilm.enabled: false

Thanks a lot

---

<div class="post-metadata">

### Author: ![B.M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b.m/32/56771_2.png) [@B.M](https://discuss.elastic.co/u/B.M)
#### Post date: [October 29, 2019, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444/6 "2019-10-29T12:46:55Z")

</div>

Happy to help 😃

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 26, 2019, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-v7-4-1-output-elasticsearch-not-writing-to-defined-index-logstash/205444/7 "2019-11-26T12:46:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
