Logstash is creating indexes named %{[@metadata][beat]}-2016.03.28 and I can't figure out why

Elastic Stack Logstash
1

here's my logstash config output:
output { if [type] == "elb" { elasticsearch { hosts => "redacted:9200" sniffing => false manage_template => false index => "s3-%{+YYYY.MM.dd}" } } elasticsearch { hosts => "redacted:9200" sniffing => false manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } }

it's correctly creating s3 index and the beats indexes (filebeat and topbeat) but for some reason it's also creating indexes named %{[@metadata][beat]}-2016.03.17 (current date). Not sure why but I assume it's something with the output.

2

As you do not have an else clause around the second Elasticsearch output, I suspect it receives all events and that some of them do not have the %{[@metadata][beat]} field defined.

3

Yep..after I submitted I added the rise and sure enough that worked.