# How am I supposed to understand why the field is confusing?

**URL:** <https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [November 14, 2021, 9:55am UTC](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132 "2021-11-14T09:55:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrchile](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@mrchile](https://discuss.elastic.co/u/mrchile)\
**Post date:** [November 14, 2021, 9:55am UTC](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132/1 "2021-11-14T09:55:04Z")

</div>

Good afternoon, colleagues. I have been playing for several hours with this incomprehensible error, how can this be - someone can explain the dependencies of fields between different products, you can link to the documentation, in general the documentation is terrible - you have to look for answers to one question in the track of different links, but this is to the topic does not apply, how to understand the essence of such errors?

```auto
[ERROR][logstash.outputs.elasticsearch][main] Invalid data stream configuration, following parameters are not supported: {"index"=>"docker-000001"}
[2021-11-14T09:50:57,530][ERROR][logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=>#<LogStash::ConfigurationError: Invalid data stream configuration: ["index"]>

```

```auto
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate_authorities => ["/certs/ca/ca.crt"]
    ssl_key => '/certs/logstash/logstash.pkcs8.key'
    ssl_certificate => '/certs/logstash/logstash.crt'
    ssl_verify_mode => "force_peer"
  }
}
output {
  elasticsearch {
    hosts => ["https://es00:9200"]
    cacert => '/certs/ca/ca.crt'
    ssl => true
    user => 'logstash_internal'
    password => 'JQhhDoQP23MN2oXTjieP'
    data_stream => true
    index => "docker-000001"
  }
}

```

```auto

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
output.logstash:
  hosts: ["logstash:5044"]
  ssl.certificate_authorities: ["/certs/ca/ca.crt"]
  ssl.certificate: "/certs/filebeat/filebeat.crt"
  ssl.key: "/certs/filebeat/filebeat.key"
  index: "docker-%{+yyyy.MM.dd}"
  ssl.enabled: true
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "docker-alias"
setup.ilm.pattern: "{now/d}-000001"

```

```auto
PUT _index_template/docker-template
{
  "index_patterns": ["docker*"],                 
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "docker-ilm",      
      "index.lifecycle.rollover_alias": "docker-alias"    
    }
  }
}
PUT docker-000001
{
  "aliases": {
    "docker-alias": {
      "is_write_index": true,
  "settings": {
      "number_of_shards": 1,  
      "number_of_replicas": 1
    }
  }
}

```

```auto
POST _aliases
{
  "actions": [
    {
      "add": {
        "index": "docker-000001",
        "alias": "docker-alias",
        "is_write_index": "true"
      }
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 14, 2021, 2:15pm UTC](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132/2 "2021-11-14T14:15:14Z")

</div>

When you use a [data stream](https://www.elastic.co/guide/en/elasticsearch/reference/current/data-streams.html#backing-indices) the index names are auto-generated, so you cannot use the index option on the output to set the name.

---

<div class="post-metadata">

**Author:** ![mrchile](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@mrchile](https://discuss.elastic.co/u/mrchile)\
**Post date:** [November 17, 2021, 1:07pm UTC](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132/3 "2021-11-17T13:07:49Z")

</div>

I may have a difficulty with the logic - help with a resource for learning?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2021, 1:08pm UTC](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132/4 "2021-12-15T13:08:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.