here's my logstash config output:
output { if [type] == "elb" { elasticsearch { hosts => "redacted:9200" sniffing => false manage_template => false index => "s3-%{+YYYY.MM.dd}" } } elasticsearch { hosts => "redacted:9200" sniffing => false manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } }
it's correctly creating s3 index and the beats indexes (filebeat and topbeat) but for some reason it's also creating indexes named %{[@metadata][beat]}-2016.03.17 (current date). Not sure why but I assume it's something with the output.