Logstash keep logging into default index


I have got an issue with logstash when i want to output logs into elasticsearch.
In my configuration below i specify an index for my logs from filebeat, but it seems that they are finally store in that index AND in the default index configured in Kibana "logstash-XX-XX-XX".

input {
  beats {
    port => 5044
  grok {
    match => [ "message", "(?m)%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:severity} {1,2}%{JAVACLASS:class} %{GREEDYDATA:message}" ]
    overwrite => [ "message" ]
  mutate {
    remove_field => [ "[beat]","input_type","offset" ]


output {
  elasticsearch {
    hosts => "d1ccelk01"
    #manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"

Anybody have an idea of the problem?

Thanks !

Is that your entire config or do you have more?

yes this is my entire logstash config.

Here is what i get :

Someone ? Any idea ?

I'm pretty sure you have additional configuration files in /etc/logstash/conf.d that you've forgotten about.

You're absolutely right! !
I thought that renaming it in *.old make it unavailable for logstash.

Thanks a lot for your help.

1 Like