# Logstash 7.1 indexing to elasticsearch problem

**URL:** https://discuss.elastic.co/t/logstash-7-1-indexing-to-elasticsearch-problem/182975
**Category:** Logstash
**Created:** [May 28, 2019, 2:56am UTC](https://discuss.elastic.co/t/logstash-7-1-indexing-to-elasticsearch-problem/182975 "2019-05-28T02:56:42Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![wcpoon](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@wcpoon](https://discuss.elastic.co/u/wcpoon)
#### Post date: [May 28, 2019, 2:56am UTC](https://discuss.elastic.co/t/logstash-7-1-indexing-to-elasticsearch-problem/182975/1 "2019-05-28T02:56:42Z")

</div>

Hi guys,

I got a problem on logstash 7.1  
Before that in logstash 6.7, i do not have this problem. My indexing name is logstash-2019.x.x  
My logstash 7.1 index to elasticsearch is only one index file instead of everyday create one index file. Now the indexing name is logstash, and keep all the data in one file only.

Is it my output config is wrong?

below are my logstash config,

```
   input {
      tcp {
        port => 5514
        type => syslog
      }
      udp {
        port => 5514
        type => syslog
        }
    }

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}

output {
  elasticsearch { hosts => ["10.3.3.41:9200"] }
  stdout { codec => rubydebug }
}
```

---

<div class="post-metadata">

### Author: ![cip\_indy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cip_indy/32/46995_2.png) [@cip\_indy](https://discuss.elastic.co/u/cip_indy)
#### Post date: [May 28, 2019, 2:31pm UTC](https://discuss.elastic.co/t/logstash-7-1-indexing-to-elasticsearch-problem/182975/2 "2019-05-28T14:31:57Z")

</div>

Add to elasticsearch output this line "index =\> "index-name-%{+YYYY.MM.dd}""

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 25, 2019, 2:32pm UTC](https://discuss.elastic.co/t/logstash-7-1-indexing-to-elasticsearch-problem/182975/3 "2019-06-25T14:32:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.