# Logstash is creating indexes named %{\[@metadata\]\[beat\]}-2016.03.28 and I can't figure out why

**URL:** https://discuss.elastic.co/t/logstash-is-creating-indexes-named-metadata-beat-2016-03-28-and-i-cant-figure-out-why/45633
**Category:** Logstash
**Created:** [March 28, 2016, 11:35pm UTC](https://discuss.elastic.co/t/logstash-is-creating-indexes-named-metadata-beat-2016-03-28-and-i-cant-figure-out-why/45633 "2016-03-28T23:35:51Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Matthew\_Prinvale](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@Matthew\_Prinvale](https://discuss.elastic.co/u/Matthew_Prinvale)
#### Post date: [March 28, 2016, 11:35pm UTC](https://discuss.elastic.co/t/logstash-is-creating-indexes-named-metadata-beat-2016-03-28-and-i-cant-figure-out-why/45633/1 "2016-03-28T23:35:51Z")

</div>

**here's my logstash config output:**  
`output { if [type] == "elb" { elasticsearch { hosts => "redacted:9200" sniffing => false manage_template => false index => "s3-%{+YYYY.MM.dd}" } } elasticsearch { hosts => "redacted:9200" sniffing => false manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } }`

it's correctly creating s3 index and the beats indexes (filebeat and topbeat) but for some reason it's also creating indexes named %{[@metadata][beat]}-2016.03.17 (current date). Not sure why but I assume it's something with the output.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 29, 2016, 1:30am UTC](https://discuss.elastic.co/t/logstash-is-creating-indexes-named-metadata-beat-2016-03-28-and-i-cant-figure-out-why/45633/2 "2016-03-29T01:30:51Z")

</div>

As you do not have an else clause around the second Elasticsearch output, I suspect it receives all events and that some of them do not have the `%{[@metadata][beat]}` field defined.

---

<div class="post-metadata">

### Author: ![Matthew\_Prinvale](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@Matthew\_Prinvale](https://discuss.elastic.co/u/Matthew_Prinvale)
#### Post date: [March 29, 2016, 2:21am UTC](https://discuss.elastic.co/t/logstash-is-creating-indexes-named-metadata-beat-2016-03-28-and-i-cant-figure-out-why/45633/3 "2016-03-29T02:21:22Z")

</div>

Yep..after I submitted I added the rise and sure enough that worked.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/logstash-is-creating-indexes-named-metadata-beat-2016-03-28-and-i-cant-figure-out-why/45633/4 "2017-07-06T05:05:05Z")

</div>