# Issue when create custom index with filebeat in elasticsearch

**URL:** <https://discuss.elastic.co/t/issue-when-create-custom-index-with-filebeat-in-elasticsearch/287976>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 29, 2021, 7:43am UTC](https://discuss.elastic.co/t/issue-when-create-custom-index-with-filebeat-in-elasticsearch/287976 "2021-10-29T07:43:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![inazo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inazo/32/96500_2.png) [@inazo](https://discuss.elastic.co/u/inazo)\
**Post date:** [October 29, 2021, 7:43am UTC](https://discuss.elastic.co/t/issue-when-create-custom-index-with-filebeat-in-elasticsearch/287976/1 "2021-10-29T07:43:08Z")

</div>

Hello,

I need to create custom index for my filebeat agent for each host. Need to separate the data collected for each host.

So i'll do this config in my filebeat.yml on the monitored host, after a large number of research on the web. :

```auto
setup.ilm.enabled: true
setup.ilm.overwrite: true
setup.ilm.rollover_alias: "filebeat-myhost-dev"
setup.ilm.pattern: "{now/M{yyyy.MM.dd}}-000001"
setup.dashboards.enabled: true
setup.dashboards.index: "filebeat-*"

setup.template.name: "filebeat-myhost-dev"
setup.template.pattern: "filebeat-myhost-dev-*"
setup.template.overwrite: true

setup.dashboard.index: "filebeat-myhost-dev-*"

```

I'll create too an index pattern **filebeat-myhost-dev-** \*.

For this i'll create a new user and a new role for the filebeat setup.

I'll add indices privileges to **filebeat-** \* and **filebeat-myhost-dev-** \* i'll add privileges :

- write
- manager
- create
- read

To the cluster privilege i'll add the following privileges :

- monitor
- manage\_ilm
- manage\_ml
- manage\_index\_templates
- manage\_ingest\_pipelines

So when on my host i'll run the command :

```auto
filebeat -e setup

```

The index was created and document are created in this index. Great !

**The problem :**

If i'll restart the service, filebeat stop creating of new document in the index... Without error message...

**The question:**

What's missing in the configuration or what's append and correct this issue.

Best regards;

---

<div class="post-metadata">

**Author:** ![inazo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inazo/32/96500_2.png) [@inazo](https://discuss.elastic.co/u/inazo)\
**Post date:** [November 25, 2021, 3:44pm UTC](https://discuss.elastic.co/t/issue-when-create-custom-index-with-filebeat-in-elasticsearch/287976/2 "2021-11-25T15:44:03Z")

</div>

No one have an idea for this problem?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2021, 3:44pm UTC](https://discuss.elastic.co/t/issue-when-create-custom-index-with-filebeat-in-elasticsearch/287976/3 "2021-12-23T15:44:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.