# Index created with wrong name

**URL:** <https://discuss.elastic.co/t/index-created-with-wrong-name/71326>\
**Category:** Logstash\
**Created:** [January 12, 2017, 7:23am UTC](https://discuss.elastic.co/t/index-created-with-wrong-name/71326 "2017-01-12T07:23:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Woo\_Lee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_woo_lee/32/14495_2.png) [@John\_Woo\_Lee](https://discuss.elastic.co/u/John_Woo_Lee)\
**Post date:** [January 12, 2017, 7:23am UTC](https://discuss.elastic.co/t/index-created-with-wrong-name/71326/1 "2017-01-12T07:23:42Z")

</div>

Hi,

I have a server with below setup

```auto
#cat /etc/redhat-release
CentOS Linux release 7.3.1611 (Core)

#timedatectl
      Local time: Thu 2017-01-12 07:21:08 GMT
  Universal time: Thu 2017-01-12 07:21:08 UTC
        RTC time: Thu 2017-01-12 07:21:08
       Time zone: Etc/GMT (GMT, +0000)
     NTP enabled: yes
NTP synchronized: yes
 RTC in local TZ: no
      DST active: n/a

#rpm -qa | grep logstash
logstash-5.1.1-1.noarch

#java -version
java version "1.8.0_112"
Java(TM) SE Runtime Environment (build 1.8.0_112-b15)
Java HotSpot(TM) 64-Bit Server VM (build 25.112-b15, mixed mode)

```

But for some reason the index being created is not what i specify in the config. Here is trace showing index created as `powerdns-1-49002.07.31` even though i specify `powerdns-1-%{+YYYY.MM.dd}`. Can someone help explain why this is happening please ? To me the year is the last part of the hosts IP and port i.e. `4:9200` !

```auto
[2017-01-12T07:05:34,767][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@hosts = ["10.149.62.14:9200"]
[2017-01-12T07:05:34,767][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@index = "powerdns-1-%{+YYYY.MM.dd}"

....

[2017-01-12T07:06:31,501][DEBUG][org.apache.http.wire] http-outgoing-0 << "{"took":760,"errors":false,"items":[{"create":{"_index":"powerdns-1-49002.07.30","_type":"logs","_id":"CQcj3m4VRk2GCfW3fhxATQ","_version":1,"status":201}},{"create":{"_index":"powerdns-1-49002.07.31","_type":"logs","_id":"iTtXt6RaSAWz4afOVRsegA","_version":1,"status":201}},{"create":{"_index":"powerdns-1-49002.07.31","_type":"logs","_id":"RQJQfPuuR6i00vgPnNd-Hg","_version":1,"status":201}}]}"

```

Here is config i'm using

```auto
input {
  file {
    path => "/var/log/mariadb/mariadb.log"
    type => "mysql_log"
    start_position => "end"
  }
}

filter {
    if [type] == "mysql_log" {
    grok {
        patterns_dir => ["/etc/logstash/patterns"]
        match => { "message" => "%{MDBLOG}" }
    }

    mutate { rename => ["message", "raw"] }
    }
}

output {

  if "_grokparsefailure" in [tags] {
    file { path => "/var/log/logstash/failed_mariadb.log.events-%{+YYYY-MM-dd}.log" }
  }

  file {
    path => '/var/log/logstash/mariadb_log.json'
  }
  
  elasticsearch {
    hosts => ["10.149.62.14:9200"]
    index => "powerdns-1-%{+YYYY.MM.dd}"
  }
  
}

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 12, 2017, 7:34am UTC](https://discuss.elastic.co/t/index-created-with-wrong-name/71326/2 "2017-01-12T07:34:55Z")

</div>

Does your message match?  
What does that grok pattern look like? What does the data look like?

---

<div class="post-metadata">

**Author:** ![John\_Woo\_Lee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_woo_lee/32/14495_2.png) [@John\_Woo\_Lee](https://discuss.elastic.co/u/John_Woo_Lee)\
**Post date:** [January 12, 2017, 8:04am UTC](https://discuss.elastic.co/t/index-created-with-wrong-name/71326/3 "2017-01-12T08:04:48Z")

</div>

Yes the grok filter works fine.. but whats the grok pattern got to do with the index that logstash sends data too.. given that i explicitly tell it what it should be named.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2017, 8:05am UTC](https://discuss.elastic.co/t/index-created-with-wrong-name/71326/4 "2017-02-09T08:05:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.