# Logstash / problem with windows index

**URL:** <https://discuss.elastic.co/t/logstash-problem-with-windows-index/347545>\
**Category:** Logstash\
**Created:** [November 20, 2023, 3:17pm UTC](https://discuss.elastic.co/t/logstash-problem-with-windows-index/347545 "2023-11-20T15:17:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![secsec](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@secsec](https://discuss.elastic.co/u/secsec)\
**Post date:** [November 20, 2023, 3:17pm UTC](https://discuss.elastic.co/t/logstash-problem-with-windows-index/347545/1 "2023-11-20T15:17:24Z")

</div>

Hello,

could you please help me?

Im using Elastic version 8.11.1

Im trying to create new 2 indexes for windows and linux.

This code below is working for linux (it is automaticaly creating indexes every day), but it is not creating indexes for windows. I can see logs via under analytics \> discover for windows.

it is windows 10 machine

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/6/960602c42c73738b850ec779d794d7d7c5077840.png)

```auto
output {
    if [host][os][type] == "windows" {
        elasticsearch {
            hosts => ["https://localhost:9200"]
            ssl_certificate_authorities => ["/etc/logstash/http_ca.crt"]
            user => 'elastic'
            password => 'somepassword'
            manage_template => false
            index => "windows-%{[host][name]}-%{+YYYY.MM.dd}"
        }
    } else if [host][os][type] == "linux" {
        elasticsearch {
            hosts => ["https://localhost:9200"]
            ssl_certificate_authorities => ["/etc/logstash/http_ca.crt"]
            user => 'elastic'
            password => 'somepassword'
            manage_template => false
            index => "linux-%{[host][name]}-%{+YYYY.MM.dd}"
        }
    } else if [@metadata][pipeline] {
        elasticsearch {
            user => 'elastic'
            password => 'somepassword'
            hosts => ["https://localhost:9200"]
            ssl_certificate_authorities => ["/etc/logstash/http_ca.crt"]
            manage_template => false
            index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
            pipeline => "%{[@metadata][pipeline]}"
        }
    } else {
        elasticsearch {
            hosts => ["https://localhost:9200"]
            user => 'elastic'
            password => 'somepassword'
            ssl_certificate_authorities => ["/etc/logstash/http_ca.crt"]
            manage_template => false
            index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        }
    }
}

```

many thanks

Martin

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 20, 2023, 5:04pm UTC](https://discuss.elastic.co/t/logstash-problem-with-windows-index/347545/2 "2023-11-20T17:04:12Z")

</div>

Can you check what is [host][os][type] for windows, is the value windows correct?  
Use rubydebug to find which values are in runtime.

---

<div class="post-metadata">

**Author:** ![secsec](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@secsec](https://discuss.elastic.co/u/secsec)\
**Post date:** [November 21, 2023, 11:59am UTC](https://discuss.elastic.co/t/logstash-problem-with-windows-index/347545/3 "2023-11-21T11:59:37Z")

</div>

Hello,

thanks for reply,

correction: sorry this is Windows server 2019 not WIN10

this is the value, that im using in logstash

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/e/0ecfb96acf253557fdc5d2491969f4cd457f28ba.png)

I tried to bounded with different parameter such as **host.os.platform** or **host.os.family** but no luck ☹

![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a06aa6439834ef7d24b551b4dc84e5a715dab7c9.png)

---

<div class="post-metadata">

**Author:** ![secsec](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@secsec](https://discuss.elastic.co/u/secsec)\
**Post date:** [November 22, 2023, 4:15pm UTC](https://discuss.elastic.co/t/logstash-problem-with-windows-index/347545/4 "2023-11-22T16:15:35Z")

</div>

Hello,

my bad, actually logs are NOT going to filebeat and then to logstash it means that creating new index for windows and new index for linux needed to be create via elasticsearch?

thanks

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 23, 2023, 3:35am UTC](https://discuss.elastic.co/t/logstash-problem-with-windows-index/347545/5 "2023-11-23T03:35:21Z")

</div>

Indices will be created automatically if IF condition is true. If there is no logs in LS, no indices in ES.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2023, 3:36am UTC](https://discuss.elastic.co/t/logstash-problem-with-windows-index/347545/6 "2023-12-21T03:36:05Z")

</div>

Closed on December 21, 2023, 3:36am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.