# Logstash index creation issue

**URL:** <https://discuss.elastic.co/t/logstash-index-creation-issue/63196>\
**Category:** Logstash\
**Created:** [October 17, 2016, 2:21pm UTC](https://discuss.elastic.co/t/logstash-index-creation-issue/63196 "2016-10-17T14:21:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![srikanth\_ramineni](https://avatars.discourse-cdn.com/v4/letter/s/aca169/32.png) [@srikanth\_ramineni](https://discuss.elastic.co/u/srikanth_ramineni)\
**Post date:** [October 17, 2016, 2:21pm UTC](https://discuss.elastic.co/t/logstash-index-creation-issue/63196/1 "2016-10-17T14:21:17Z")

</div>

Hi,

our system generate netstat and vmstat every half hour and we are ingesting the data and we are overriding the timestamp with my log time stamp in logstash.  
We have below issue when we are ingesting the historical data.  
we are having one week netstat data and one day vmstat data. When we are ingesting the data, netstat and vmstat both are creating with 7 different indexes with dates. The issue is vmstat should create only one index as it is having only one day data but it is creating 7 indexes. when both indexes having same dates data, indexes are creating properly. Is there any way to fix this kind of issues.  
We are using file beat to push the data logstash.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 18, 2016, 5:59am UTC](https://discuss.elastic.co/t/logstash-index-creation-issue/63196/2 "2016-10-18T05:59:32Z")

</div>

More details please. What do the configuration files look like? What do the events that are incorrectly spread out over 7 indexes look like?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/logstash-index-creation-issue/63196/3 "2017-07-06T04:33:50Z")

</div>

Closed on July 6, 2017, 4:33am UTC


