# Logstash keep logging into default index

**URL:** <https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643>\
**Category:** Logstash\
**Created:** [June 22, 2016, 9:58am UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643 "2016-06-22T09:58:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![siasic](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@siasic](https://discuss.elastic.co/u/siasic)\
**Post date:** [June 22, 2016, 9:58am UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643/1 "2016-06-22T09:58:59Z")

</div>

Hello,

I have got an issue with logstash when i want to output logs into elasticsearch.  
In my configuration below i specify an index for my logs from filebeat, but it seems that they are finally store in that index AND in the default index configured in Kibana "logstash-XX-XX-XX".

```
input {
  beats {
    port => 5044
  }
}
filter{
  grok {
    match => ["message", "(?m)%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:severity} {1,2}%{JAVACLASS:class} %{GREEDYDATA:message}"]
    overwrite => ["message"]
  }
  mutate {
    remove_field => ["[beat]","input_type","offset" ]
  }

}

output {
  elasticsearch {
    hosts => "d1ccelk01"
    #manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

Anybody have an idea of the problem?

Thanks !

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 22, 2016, 10:55pm UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643/2 "2016-06-22T22:55:38Z")

</div>

Is that your entire config or do you have more?

---

<div class="post-metadata">

**Author:** ![siasic](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@siasic](https://discuss.elastic.co/u/siasic)\
**Post date:** [June 23, 2016, 6:49am UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643/3 "2016-06-23T06:49:47Z")

</div>

yes this is my entire logstash config.

Here is what i get :

 ![](https://us1.discourse-cdn.com/elastic/original/2X/7/7934068caad6d58db5a3d7a0274b0ef040b0a4a7.png)

---

<div class="post-metadata">

**Author:** ![siasic](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@siasic](https://discuss.elastic.co/u/siasic)\
**Post date:** [July 4, 2016, 7:42am UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643/4 "2016-07-04T07:42:04Z")

</div>

Someone ? Any idea ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 4, 2016, 6:39pm UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643/5 "2016-07-04T18:39:53Z")

</div>

I'm pretty sure you have additional configuration files in /etc/logstash/conf.d that you've forgotten about.

---

<div class="post-metadata">

**Author:** ![siasic](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@siasic](https://discuss.elastic.co/u/siasic)\
**Post date:** [July 5, 2016, 6:55am UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643/6 "2016-07-05T06:55:44Z")

</div>

You're absolutely right! !  
I thought that renaming it in \*.old make it unavailable for logstash.

Thanks a lot for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643/7 "2017-07-06T04:49:34Z")

</div>