# Index tag in Logstash output doesn't seem to work

**URL:** <https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 4, 2016, 9:35pm UTC](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008 "2016-02-04T21:35:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rawill](https://avatars.discourse-cdn.com/v4/letter/r/3ab097/32.png) [@rawill](https://discuss.elastic.co/u/rawill)\
**Post date:** [February 4, 2016, 9:35pm UTC](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008/1 "2016-02-04T21:35:26Z")

</div>

While testing Winlogbeat we set the index in the Logstash output but never see it getting passed. Anyone else seeing similar to this?

What I have set in my yml:

# Optional index name. The default index name depends on the each beat.

```
# For Packetbeat, the default is set to packetbeat, for Topbeat
# top topbeat and for Filebeat to filebeat.
index: "testindex"

```

Sample of my output:  
{"message":"The Windows Installer service entered the running state.","@version":"1","@timestamp":"2015-05-15T17:24:00.483Z","beat":{"hostname":"rawill1014","name":"rawill"},"computer\_name":"[rawill1014.blah.blah.net](http://rawill1014.blah.blah.net)","count":1,"event\_id":7036,"level":"Information","log\_name":"System","record\_number":"81567","source\_name":"Service Control Manager","tags":["winlogbeat","web-tier"],"type":"wineventlog","host":"rawill1014","LS":"LS1-368"}

I this is what I see when I do a file output to see what fields are being passed around.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 4, 2016, 9:52pm UTC](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008/2 "2016-02-04T21:52:32Z")

</div>

The `@metadata` field that contains the `index` field is only generated by the Logstash output. You won't see it in the file output.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 4, 2016, 9:55pm UTC](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008/3 "2016-02-04T21:55:43Z")

</div>

Use this in your Logstash output if you want to view the `@metadata` contents:

`stdout { codec => rubydebug { metadata => true } }`

`@metadata` is always filtered by Logstash outputs.

Reference: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#metadata](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#metadata)

---

<div class="post-metadata">

**Author:** ![rawill](https://avatars.discourse-cdn.com/v4/letter/r/3ab097/32.png) [@rawill](https://discuss.elastic.co/u/rawill)\
**Post date:** [February 4, 2016, 10:35pm UTC](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008/4 "2016-02-04T22:35:45Z")

</div>

Just tried that changed the value in the yml for index to BBBBBBBBB so it would be easy to find. It did not come out like I thought it would instead the value being in tag index it's in tag "beat". So is this the way it's going to work?

"@metadata" =\> {  
"beat" =\> "BBBBBBBBB",  
"type" =\> "wineventlog"  
}

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 4, 2016, 11:36pm UTC](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008/5 "2016-02-04T23:36:33Z")

</div>

> [@rawill](#):
>
> So is this the way it's going to work?

Yes, that is what I expected.

In your LS config you would use something like:

```auto
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }

```

Reference: [Get started with Beats | Beats Platform Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/libbeat/current/getting-started.html#logstash-setup)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 6, 2016, 6:27pm UTC](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008/6 "2016-04-06T18:27:56Z")

</div>