Logstash Index

Elastic Stack Logstash
3

Hi, thanks for replying.

I just noticed this thread [ATTENTION] Logstash 6.0.0 - Known Issue Indexing to Elasticsearch 6.0

After I adding the document type, now it can work but the result still not what I am expecting

[2017-12-13T10:17:54,533][INFO ][o.e.c.m.MetaDataMappingService] [6p1K6V1] [%{[@metadata][beat]}-2017.12.14/iMGnWDl4QdCsN-jbdWXezg] create_mapping [doc]
[2017-12-13T10:17:58,651][INFO ][o.e.c.m.MetaDataMappingService] [6p1K6V1] [%{[@metadata][beat]}-2017.12.14/iMGnWDl4QdCsN-jbdWXezg] update_mapping [doc]
[2017-12-13T10:18:05,290][INFO ][o.e.c.m.MetaDataMappingService] [6p1K6V1] [%{[@metadata][beat]}-2017.12.14/iMGnWDl4QdCsN-jbdWXezg] update_mapping [doc]
[2017-12-13T10:19:36,614][INFO ][o.e.c.m.MetaDataMappingService] [6p1K6V1] [%{[@metadata][beat]}-2017.12.14/iMGnWDl4QdCsN-jbdWXezg] update_mapping [doc]

Does the double quote or single quote affect the result?

elasticsearch { 
     hosts => ["localhost:9200"] 
     index => "%{[@metadata][beat]}-%{index_day}"
     document_type => doc
}