# Metricbeat behind logstash (index and dashboard generation)
**URL:** https://discuss.elastic.co/t/metricbeat-behind-logstash-index-and-dashboard-generation/226295
**Category:** Elasticsearch
**Created:** [April 3, 2020, 12:27am UTC](https://discuss.elastic.co/t/metricbeat-behind-logstash-index-and-dashboard-generation/226295 "2020-04-03T00:27:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Trolldemorted](https://discuss.elastic.co/u/Trolldemorted)
#### Post date: [April 3, 2020, 12:27am UTC](https://discuss.elastic.co/t/metricbeat-behind-logstash-index-and-dashboard-generation/226295/1 "2020-04-03T00:27:08Z")
Hi,
I have several servers with beats which talk to my logstash, and each should go into a separate index:
```auto
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["http://elasticsearch:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}"
}
}
```
As long as I run and finish `metricbeat setup -e -E output.logstash.enabled=false -E output.elasticsearch.hosts=['localhost:9200'] -E setup.kibana.host=localhost:5601` _before the first metricbeat sends data_, it is all fun and games: It creates an index per day (e.g. `metricbeat-7.6.2-2020.04.03-000001`), creates the dashboards, and logstash uses that index to store the incoming events (why/how does that work, by the way?).
Unfortunately in my orchestration setup, I cannot easily run `metricbeat setup` before events arrive, so logstash has created an index called `metricbeat-7.6.2` before it runs, and I cannot convince it to modify that index: it always says `Exiting: resource 'metricbeat-7.6.2' exists, but it is not an alias`.
Can I tell it to forcefully edit the index and make things work? I have tried hacks like "delete the index with curl and quickly run setup" (new data arrives too fast) and the options `-E setup.template.overwrite=true` and `-E setup.ilm.overwrite=true`, but it that did not help at all.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [April 3, 2020, 2:07pm UTC](https://discuss.elastic.co/t/metricbeat-behind-logstash-index-and-dashboard-generation/226295/2 "2020-04-03T14:07:26Z")
You need to set up the index template (the work done by metricbeat) before logstash starts indexing. You could also run a `metricbeat setup` run from the logstash host with the right configuration, as that one is able to reach elasticsearch - but you have to do this before the first indexing happens.
---
### Author:  [@Trolldemorted](https://discuss.elastic.co/u/Trolldemorted)
#### Post date: [April 3, 2020, 2:36pm UTC](https://discuss.elastic.co/t/metricbeat-behind-logstash-index-and-dashboard-generation/226295/3 "2020-04-03T14:36:59Z")
There is no way to do it after logstash has started? Isn't this a situation migrations always encounter? I could totally live with data loss or having to restart logstash once.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2020, 2:37pm UTC](https://discuss.elastic.co/t/metricbeat-behind-logstash-index-and-dashboard-generation/226295/4 "2020-05-01T14:37:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.