# Index is loaded with data from other indexes

**URL:** <https://discuss.elastic.co/t/index-is-loaded-with-data-from-other-indexes/154859>\
**Category:** Logstash\
**Created:** [October 31, 2018, 2:19pm UTC](https://discuss.elastic.co/t/index-is-loaded-with-data-from-other-indexes/154859 "2018-10-31T14:19:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bueka.torao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bueka.torao/32/47806_2.png) [@bueka.torao](https://discuss.elastic.co/u/bueka.torao)\
**Post date:** [October 31, 2018, 2:19pm UTC](https://discuss.elastic.co/t/index-is-loaded-with-data-from-other-indexes/154859/1 "2018-10-31T14:19:41Z")

</div>

Hi all, I need some help here!

I am reading logs from my FTP server, also from some different servers I am using filebeats + logstash + elasticsearch + kibana.

Mail server -\> filebeats -\> logstash 5045 index maillog-\*  
FTP server -\> filebeats -\> logstash 5046 index pureftp-\*

Filebeats sends data to logstash using a separate port 5046 for ftp logs. I created a filter and index for ftp logs. The FTP server is the only one sending logs to that specific port. however, the mapping at kibana shows the maillog index mapping. And, the pureftp index shows maillog data.

Why is that happing?

**MAIL server name: relaysrv**  
**Filebeats configuration:**  
filebeat.inputs:

- type: log  
enabled: true  
paths:
  - /var/log/\*.log
  - /var/log/maillog  
filebeat.config.modules:  
path: ${path.config}/modules.d/\*.yml  
reload.enabled: true  
setup.template.settings:  
index.number\_of\_shards: 3  
setup.kibana:  
output.logstash:  
hosts: ["192.XX.XX.XX:5045"]

**Logstash configuration:**  
input {  
beats {  
port =\> 5045  
}  
}  
filter {  
grok {  
patterns\_dir =\> ["/etc/logstash/patterns.d"]  
match =\> { "message" =\> ["%{PF}"] }  
}  
date {  
match =\> ["timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss"]  
}  
geoip {  
source =\> "relayip"  
}  
}  
output {  
elasticsearch {  
index =\> "maillog-%{+YYYY.MM.dd}"  
hosts =\> ["127.0.0.1:9200"]  
manage\_template =\> true  
template\_overwrite =\> true  
template =\> "/etc/logstash/templates/maillog.json"  
template\_name =\> "maillog"  
}  
}

**FTP server name: ftp7srv**  
**Filebeats configuration:**

filebeat.inputs:

- type: log  
enabled: true  
paths:
  - /var/log/pureftpd.log  
filebeat.config.modules:  
path: ${path.config}/modules.d/\*.yml  
reload.enabled: true  
setup.template.settings:  
index.number\_of\_shards: 3  
setup.kibana:  
output.logstash:  
hosts: ["192.xxx.xx.xx:5046"]

**Logstash configuration:**

input {  
beats {  
port =\> 5046  
}  
}  
filter {  
grok {  
patterns\_dir =\> "/etc/logstash/patterns.d"  
match =\> ["message", "%{PUREFTPTRANSFER}"]  
add\_tag =\> ["pureftp\_transfer", "pureftp\_parse"]  
}  
grok {  
patterns\_dir =\> "/etc/logstash/patterns.d"  
match =\> ["message", "%{PUREFTPAUTHFAIL}"]  
add\_tag =\> ["pureftp\_auth\_fail", "pureftp\_parse"]  
}  
grok {  
patterns\_dir =\> "/etc/logstash/patterns.d"  
match =\> ["message", "%{PUREFTPAUTHSUCCESS}"]  
add\_tag =\> ["pureftp\_auth\_success", "pureftp\_parse"]  
}  
if "pureftp\_parse" not in [tags] {  
grok {  
patterns\_dir =\> "/etc/logstash/patterns.d"  
match =\> ["message", "%{PUREFTPSYSLOG}"]  
add\_tag =\> ["pureftp\_syslog", "pureftp\_parse"]  
}  
}  
mutate {  
gsub =\> ["remote", "\_", ":"]  
}  
date {  
timezone =\> "Europe/Amsterdam"  
match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"]  
}  
geoip {  
source =\> "remote"  
}  
}  
output {  
elasticsearch {  
index =\> "pureftp-%{+YYYY.MM.dd}"  
hosts =\> ["127.0.0.1:9200"]  
manage\_template =\> true  
template\_overwrite =\> true  
template =\> "/etc/logstash/templates/pureftp.json"  
template\_name =\> "pureftp"  
}  
}

Filebeat Version: 6.4

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2018, 2:26pm UTC](https://discuss.elastic.co/t/index-is-loaded-with-data-from-other-indexes/154859/2 "2018-11-28T14:26:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.