# Index Name not expected

**URL:** <https://discuss.elastic.co/t/index-name-not-expected/128573>\
**Category:** Logstash\
**Created:** [April 18, 2018, 3:58pm UTC](https://discuss.elastic.co/t/index-name-not-expected/128573 "2018-04-18T15:58:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dhenshaw](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@dhenshaw](https://discuss.elastic.co/u/dhenshaw)\
**Post date:** [April 18, 2018, 3:58pm UTC](https://discuss.elastic.co/t/index-name-not-expected/128573/1 "2018-04-18T15:58:46Z")

</div>

Hello,

I have an ElasticStack setup, and am looking at simplifying the footprint. As such I have setup an rsyslog server, which will ship the logs to logstash, store in elasticsearch, and viewable in Kibana.

Using guides found online the rsyslog server I have this json template:

template(name="json-template"  
type="list") {  
constant(value="{")  
constant(value=""@timestamp":"") property(name="timereported" dateFormat="rfc3339")  
constant(value="","@version":"1")  
constant(value="","message":"") property(name="msg" format="json")  
constant(value="","sysloghost":"") property(name="hostname")  
constant(value="","severity":"") property(name="syslogseverity-text")  
constant(value="","facility":"") property(name="syslogfacility-text")  
constant(value="","programname":"") property(name="programname")  
constant(value="","procid":"") property(name="procid")  
constant(value=""}\n")  
}

Simple output file on rsyslog:

# This line sends all lines to defined IP address at port 10514,

# using the "json-template" format template

_._@192.168.19.122:10514;json-template

And in logstash the input file is as so:

# This input block will listen on port 10514 for logs to come in.

# host should be an IP on the Logstash server.

# codec =\> "json" indicates that we expect the lines we're receiving to be in JSON format

# type =\> "rsyslog" is an optional identifier to help identify messaging streams in the pipeline.

input {  
udp {  
host =\> "192.168.19.122"  
port =\> 10514  
codec =\> "json"  
type =\> "rsyslog"  
}  
}

# This is an empty filter block. You can later add other filters here to further process

# your log lines

filter { }

# This output block will send all events of type "rsyslog" to Elasticsearch at the configured

# host and port into daily indices of the pattern, "rsyslog-YYYY.MM.DD"

output {  
if [type] == "rsyslog" {  
elasticsearch {  
hosts =\> ["192.168.19.122:9200"]  
}  
}  
}

My issue, whether I specifically name the index or not, is that the index name becomes this:

%{[@metadata][beat]}-%{[@metadata][version]}-2018.04.18

Any idea what I've got wrong.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 22, 2018, 8:14pm UTC](https://discuss.elastic.co/t/index-name-not-expected/128573/2 "2018-04-22T20:14:22Z")

</div>

Do you have another configuration file in the same directory containing

```nohighlight
elasticsearch {
  ...
  index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}

```

?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2018, 8:14pm UTC](https://discuss.elastic.co/t/index-name-not-expected/128573/3 "2018-05-20T20:14:29Z")

</div>

Closed on May 20, 2018, 8:14pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.