# Index problem .keyword

**URL:** <https://discuss.elastic.co/t/index-problem-keyword/308112>\
**Category:** Kibana\
**Tags:** docker\
**Created:** [June 24, 2022, 12:08pm UTC](https://discuss.elastic.co/t/index-problem-keyword/308112 "2022-06-24T12:08:57Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 24, 2022, 3:40pm UTC](https://discuss.elastic.co/t/index-problem-keyword/308112/5 "2022-06-24T15:40:11Z")

</div>

Ok 🙂

You did not say you were using logstash in the middle so there is more to do...

> [@AnotherGuy](#):
>
> but setup the filbeat i can uncomment my logstash.output ?

Yes comment out the logstash output during setup and set elasticsearch output.  
Then comment out the elasticsearch output and uncomment the logstash output when running through logstash.

I usually _ **highly** _ recommend to get everything working using the direct architecture.

Filebeat -\> Elasticsearch

Before trying and moving on to the more complex architecture.

Filebeat -\> logstash -\> Elasticsearch

Also since you are using logstash your pipeline needs to be "filebeat" aware please see [this doc](https://www.elastic.co/guide/en/logstash/7.17/use-ingest-pipelines.html)

You pipeline should look something like

```auto
input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://yourhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://yourhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      user => "elastic"
      password => "secret"
    }
  }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/index-problem-keyword/308112)._