# Index Creation for Fortinet Devices Fail
**URL:** https://discuss.elastic.co/t/index-creation-for-fortinet-devices-fail/316116
**Category:** Beats
**Tags:** filebeat
**Created:** [October 8, 2022, 3:54am UTC](https://discuss.elastic.co/t/index-creation-for-fortinet-devices-fail/316116 "2022-10-08T03:54:25Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)
#### Post date: [October 8, 2022, 3:54am UTC](https://discuss.elastic.co/t/index-creation-for-fortinet-devices-fail/316116/1 "2022-10-08T03:54:25Z")
Hello Elastic Team,
I would like to ask for help for I my filebeat seems like to fail creating index for my fortinet firewall (I use Fortinet filebeat module). Filebeat version is 7.17.15. However, the fortigate logs falls into index filebeat-\*
Filebeat.yml:
output.elasticsearch:
hosts: ["172.30.169.50:9200"]
ssl.verification\_mode: "none"
username: "elastic"
password: "m4gN3s1@.123"
indices:
- index: "sdwan-%{+yyyy.MM.dd}"
when.contains:
observer.name: "SDWAN"
- index: "mpls-%{+yyyy.MM.dd}"
when.contains:
host.name: "MPLS"
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [October 10, 2022, 3:24pm UTC](https://discuss.elastic.co/t/index-creation-for-fortinet-devices-fail/316116/2 "2022-10-10T15:24:06Z")
Hey @gisellecarballo,
Filebeat indexes are managed by default with ILM, to customize their names, you need to disable ILM, or use ILM options.
Take a look here: [Configure index lifecycle management | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/ilm.html)
---
### Author:  [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)
#### Post date: [October 20, 2022, 10:19am UTC](https://discuss.elastic.co/t/index-creation-for-fortinet-devices-fail/316116/3 "2022-10-20T10:19:45Z")
Hi @jsoriano ,
It seems like there are fields that able to process by filebeat. when I tried to filter using field event.module instead of observer.name it worked.
Any reason for that ?
Thanks a lot!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 17, 2022, 12:19pm UTC](https://discuss.elastic.co/t/index-creation-for-fortinet-devices-fail/316116/4 "2022-11-17T12:19:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.