# Index Pattern issue

**URL:** <https://discuss.elastic.co/t/index-pattern-issue/121879>\
**Category:** Logstash\
**Created:** [February 28, 2018, 3:40pm UTC](https://discuss.elastic.co/t/index-pattern-issue/121879 "2018-02-28T15:40:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bakkali\_Amine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bakkali_amine/32/91129_2.png) [@Bakkali\_Amine](https://discuss.elastic.co/u/Bakkali_Amine)\
**Post date:** [February 28, 2018, 3:40pm UTC](https://discuss.elastic.co/t/index-pattern-issue/121879/1 "2018-02-28T15:40:55Z")

</div>

When I add an "if" in my output kibana don't know the pattern

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [February 28, 2018, 3:46pm UTC](https://discuss.elastic.co/t/index-pattern-issue/121879/2 "2018-02-28T15:46:39Z")

</div>

Hi,

I am sorry but this is to vague, could please explain what you are doing and what the expected result is?

---

<div class="post-metadata">

**Author:** ![Bakkali\_Amine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bakkali_amine/32/91129_2.png) [@Bakkali\_Amine](https://discuss.elastic.co/u/Bakkali_Amine)\
**Post date:** [February 28, 2018, 3:49pm UTC](https://discuss.elastic.co/t/index-pattern-issue/121879/3 "2018-02-28T15:49:05Z")

</div>

this is my output :  
output {  
if "ossec" in [tags] {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "ossec-%{+YYYY.MM.dd}"  
document\_type =\> "ossec"  
}  
}  
}  
when i want to add the pattern ossec i can't

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [February 28, 2018, 4:14pm UTC](https://discuss.elastic.co/t/index-pattern-issue/121879/4 "2018-02-28T16:14:59Z")

</div>

Can you post received message? as in the input you get?

---

<div class="post-metadata">

**Author:** ![Bakkali\_Amine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bakkali_amine/32/91129_2.png) [@Bakkali\_Amine](https://discuss.elastic.co/u/Bakkali_Amine)\
**Post date:** [February 28, 2018, 4:19pm UTC](https://discuss.elastic.co/t/index-pattern-issue/121879/5 "2018-02-28T16:19:39Z")

</div>

How ?  
this is my input :  
input {  
file {  
path =\> "/var/ossec/logs/alerts/alerts.json"  
codec =\> "json"  
tags =\> ["ossec"]  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2018, 4:20pm UTC](https://discuss.elastic.co/t/index-pattern-issue/121879/6 "2018-03-28T16:20:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.