Hi, thanks for replying.
I just noticed this thread [ATTENTION] Logstash 6.0.0 - Known Issue Indexing to Elasticsearch 6.0
After I adding the document type, now it can work but the result still not what I am expecting
[2017-12-13T10:17:54,533][INFO ][o.e.c.m.MetaDataMappingService] [6p1K6V1] [%{[@metadata][beat]}-2017.12.14/iMGnWDl4QdCsN-jbdWXezg] create_mapping [doc]
[2017-12-13T10:17:58,651][INFO ][o.e.c.m.MetaDataMappingService] [6p1K6V1] [%{[@metadata][beat]}-2017.12.14/iMGnWDl4QdCsN-jbdWXezg] update_mapping [doc]
[2017-12-13T10:18:05,290][INFO ][o.e.c.m.MetaDataMappingService] [6p1K6V1] [%{[@metadata][beat]}-2017.12.14/iMGnWDl4QdCsN-jbdWXezg] update_mapping [doc]
[2017-12-13T10:19:36,614][INFO ][o.e.c.m.MetaDataMappingService] [6p1K6V1] [%{[@metadata][beat]}-2017.12.14/iMGnWDl4QdCsN-jbdWXezg] update_mapping [doc]
Does the double quote or single quote affect the result?
elasticsearch {
hosts => ["localhost:9200"]
index => "%{[@metadata][beat]}-%{index_day}"
document_type => doc
}