# Indexes with FileBeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 6, 2016, 10:46am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873 "2016-09-06T10:46:00Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Apurv\_Jain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apurv_jain/32/64486_2.png) [@Apurv\_Jain](https://discuss.elastic.co/u/Apurv_Jain)\ **Post date:** [September 6, 2016, 10:46am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/1 "2016-09-06T10:46:00Z")
Hi, I am using file beat to transfer logs to elastic. Everything is working fine, the only issue is that filebeat adds date to the ES index, so if my index name is "Test", how filebeat creates it on ES is "Test-YYYY.MM.dd" i.e. appending the timestamp. Is there anyway to override this default behavior? ---
**Author:** ![tanguy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanguy/32/6030_2.png) [@tanguy](https://discuss.elastic.co/u/tanguy)\ **Post date:** [September 6, 2016, 10:55am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/2 "2016-09-06T10:55:27Z")
Hi, According to the documentation (see [https://www.elastic.co/guide/en/beats/filebeat/1.3/elasticsearch-output.html#\_index](https://www.elastic.co/guide/en/beats/filebeat/1.3/elasticsearch-output.html#_index)), you must configure the `index` option of the Elasticsearch Output: ``` output: elasticsearch: index: "foo" ``` ---
**Author:** ![Apurv\_Jain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apurv_jain/32/64486_2.png) [@Apurv\_Jain](https://discuss.elastic.co/u/Apurv_Jain)\ **Post date:** [September 6, 2016, 11:47am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/3 "2016-09-06T11:47:05Z")
Hey, Thats exactly what I've done. > elasticsearch: > # Array of hosts to connect to. > # Scheme and port can be left out and will be set to the default (http and 9200) > # In case you specify and additional path, the scheme is required: [http://localhost:9200/path](http://localhost:9200/path) > # IPv6 addresses should always be defined as: https://[2001:db8::1]:9200 > hosts: ["localhost:9200"] > ``` > # Optional protocol and basic auth credentials. > #protocol: "https" > #username: "admin" > #password: "s3cr3t" > > ``` > ``` > # Number of workers per Elasticsearch host. > #worker: 1 > > ``` > ``` > # Optional index name. The default is "filebeat" and generates > # [filebeat-]YYYY.MM.DD keys. > index: "test2" > > ``` But the index created inside elasticsearch is like test2-2016.08.02. I don't want this timestamp following the index name. Thanks ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [September 6, 2016, 1:25pm UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/4 "2016-09-06T13:25:44Z")
In the 1.x version it is not possible to disable the daily indices. If you prefer a different pattern, I recommend to use Logstash where you can adjust the index to your needs. In the upcoming 5.0 release it will be possible to define your own pattern (or leave out the pattern): See [https://github.com/elastic/beats/blob/master/filebeat/filebeat.full.yml#L328](https://github.com/elastic/beats/blob/master/filebeat/filebeat.full.yml#L328) This is currently only available in our snapshot builds: [https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/) ---
**Author:** ![Apurv\_Jain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apurv_jain/32/64486_2.png) [@Apurv\_Jain](https://discuss.elastic.co/u/Apurv_Jain)\ **Post date:** [September 6, 2016, 1:55pm UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/5 "2016-09-06T13:55:35Z")
Hi Ruflin, I am using filebeat 5.0.0, How to disable daily indices in in this? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [September 7, 2016, 3:15pm UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/6 "2016-09-07T15:15:18Z")
Daily indices are generated for users to be able to drop old indices e.g. using curator (unless you've got infinite disk space). Otherwise dropping old data can become a very expensive operation. Querying all data via REST api is still possible using `filebeat-*` as index. In beta1 `index` will become a format-string with default being `filebeat-%{+yyyy.MM.dd}`. ---
**Author:** ![Apurv\_Jain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apurv_jain/32/64486_2.png) [@Apurv\_Jain](https://discuss.elastic.co/u/Apurv_Jain)\ **Post date:** [September 12, 2016, 7:05am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/7 "2016-09-12T07:05:30Z")
Thanks Steffens that helped. Can I except parsing of Logs in JSON in the stable version of filebeat out any soon? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [September 12, 2016, 9:15am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/8 "2016-09-12T09:15:56Z")
JSON support is part of 5.0 release. A 5.0 beta1 release should be available soon. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 27, 2016, 10:46am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873/9 "2016-09-27T10:46:08Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.