# Index Default Name

**URL:** <https://discuss.elastic.co/t/index-default-name/185943>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 15, 2019, 3:06pm UTC](https://discuss.elastic.co/t/index-default-name/185943 "2019-06-15T15:06:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stevetso](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stevetso/32/27438_2.png) [@stevetso](https://discuss.elastic.co/u/stevetso)\
**Post date:** [June 15, 2019, 3:06pm UTC](https://discuss.elastic.co/t/index-default-name/185943/1 "2019-06-15T15:06:01Z")

</div>

According to doc, the default name of index name would be:

The default is "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

but I found the index name of auto created index is simply "filebeat-7.0.1".

I tried to add this line under output.elasticsearch but problem cannot be resolved.

index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

Anyone has this experience? How to fix? Thanks.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [June 15, 2019, 4:05pm UTC](https://discuss.elastic.co/t/index-default-name/185943/2 "2019-06-15T16:05:39Z")

</div>

Yep, you had an event where the @datestamp didn't grok. The fix depends on your data. I encountered it in Apache logs that appear to be from ddos attempts. I just added code something like if no @datestamp, make it "now".

I had extracted the filebeat ingest pipeline for use in logstash, but the same problem probably occurs if using ES ingest mode.

Also, if you have trouble seeing these events in Kibana, create a index pattern w/o using a timestamp. A name like "filebeat-7\*" to be different from the "filebeat\*" you probably have now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2019, 4:05pm UTC](https://discuss.elastic.co/t/index-default-name/185943/3 "2019-07-13T16:05:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.