# Logstash won't create ES indexes (but will store data)

**URL:** <https://discuss.elastic.co/t/logstash-wont-create-es-indexes-but-will-store-data/69193>\
**Category:** Logstash\
**Created:** [December 15, 2016, 4:26pm UTC](https://discuss.elastic.co/t/logstash-wont-create-es-indexes-but-will-store-data/69193 "2016-12-15T16:26:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gamaier](https://avatars.discourse-cdn.com/v4/letter/g/eb8c5e/32.png) [@gamaier](https://discuss.elastic.co/u/gamaier)\
**Post date:** [December 15, 2016, 4:26pm UTC](https://discuss.elastic.co/t/logstash-wont-create-es-indexes-but-will-store-data/69193/1 "2016-12-15T16:26:16Z")

</div>

I'm having an odd issue with logstash that I've never run into before.  
I spun up a new 5.1 stack the other day and for some reason logstash doesn't seem to be creating an index by itself.  
I'll get the error:

:response=\>{"index"=\>{"\_index"=\>"winlogbeat-2016.12.15", "\_type"=\>"wineventlog", "\_id"=\>nil, "status"=\>404, "error"=\>{"type"=\>"index\_not\_found\_exception", "reason"=\>"no such index", "resource.type"=\>"index\_expression", "[resource.id](http://resource.id)"=\>"winlogbeat-2016.12.15", "index\_uuid"=\>"_na_", "index"=\>"winlogbeat-2016.12.15"}}}}

If I manually create the index winlogbeat-2016.12.15 or whatever day it is, it it will then proceed to stream data to ES and everything else works fine.

Does anyone have any thoughts on that?

For reference, my logstash conf is as follows:

input {  
beats {  
port =\> "5044"  
}

}

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

This seems OK as far as I can tell, so I'm not entirely sure where I should be looking.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 15, 2016, 11:01pm UTC](https://discuss.elastic.co/t/logstash-wont-create-es-indexes-but-will-store-data/69193/2 "2016-12-15T23:01:13Z")

</div>

You didn't disable auto creation of indices in the ES config did you?

---

<div class="post-metadata">

**Author:** ![gamaier](https://avatars.discourse-cdn.com/v4/letter/g/eb8c5e/32.png) [@gamaier](https://discuss.elastic.co/u/gamaier)\
**Post date:** [December 16, 2016, 5:43pm UTC](https://discuss.elastic.co/t/logstash-wont-create-es-indexes-but-will-store-data/69193/3 "2016-12-16T17:43:21Z")

</div>

Thanks for pointing that out! I completely forgot to set up ES to auto create indices for that pattern.  
Definitely feeling a bit like an elastic noob... still figuring out all the moving parts.  
Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2017, 5:43pm UTC](https://discuss.elastic.co/t/logstash-wont-create-es-indexes-but-will-store-data/69193/4 "2017-01-13T17:43:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.