# Meta data not written to logstash output file

**URL:** <https://discuss.elastic.co/t/meta-data-not-written-to-logstash-output-file/327366>\
**Category:** Elasticsearch\
**Created:** [March 9, 2023, 2:02pm UTC](https://discuss.elastic.co/t/meta-data-not-written-to-logstash-output-file/327366 "2023-03-09T14:02:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![eeijlar](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@eeijlar](https://discuss.elastic.co/u/eeijlar)\
**Post date:** [March 9, 2023, 2:02pm UTC](https://discuss.elastic.co/t/meta-data-not-written-to-logstash-output-file/327366/1 "2023-03-09T14:02:14Z")

</div>

I am using the following logstash pipeline:

```auto
- pipeline.id: export-process
      pipeline.workers: 4
      config.string: |
        input {
          elasticsearch {
            hosts => "http://elastic:80/elasticsearch/"
            user => "elastic"
            password => ""
            ssl => "false"
            index => "metricbeat-*"
            docinfo => true
            query => '{
                "query": {
                  "bool": {
                    "filter": {
                      "range": {
                          "@timestamp": {
                          "gte": "now-35m",
                          "lte": "now",
                          "format": "strict_date_optional_time||epoch_millis"
                          }
                      }
                    }
                  }
              }
            }'
          }
        }
        output {
          file {
            gzip => "true"
            path => "/usr/share/logstash/export/export_%{[@metadata][_index]}.json.gz"
          }
        }

```

This however just creates raw blobs of json with no meta data surrounding the document such as the index it came from etc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2023, 2:02pm UTC](https://discuss.elastic.co/t/meta-data-not-written-to-logstash-output-file/327366/2 "2023-04-06T14:02:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.