# Multiple Indexes Created Instead of One

**URL:** <https://discuss.elastic.co/t/multiple-indexes-created-instead-of-one/110348>\
**Category:** Logstash\
**Created:** [December 5, 2017, 12:46pm UTC](https://discuss.elastic.co/t/multiple-indexes-created-instead-of-one/110348 "2017-12-05T12:46:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![HilariousGil](https://avatars.discourse-cdn.com/v4/letter/h/90ced4/32.png) [@HilariousGil](https://discuss.elastic.co/u/HilariousGil)\
**Post date:** [December 5, 2017, 12:46pm UTC](https://discuss.elastic.co/t/multiple-indexes-created-instead-of-one/110348/1 "2017-12-05T12:46:07Z")

</div>

Hi,

I'm using Logstash to create a new index and the index name is set like this:  
- index =\> "name-%{+YYYY-MM-dd.HH-mm}"

The execution of Logstash takes a bit **more than one minute** to process so once it is finished I end up with 2 Indexes:  
- name-2017-12-05. **13-00** - With part of the documents  
- name-2017-12-05. **13-01** - With the rest of the documents

I would like to have everything on the same index and keep the minutes information on the name. Is there a way to achieve this?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 5, 2017, 1:17pm UTC](https://discuss.elastic.co/t/multiple-indexes-created-instead-of-one/110348/2 "2017-12-05T13:17:30Z")

</div>

There's no obvious way of doing this. Why do you need minute resolution for the indexes?

---

<div class="post-metadata">

**Author:** ![HilariousGil](https://avatars.discourse-cdn.com/v4/letter/h/90ced4/32.png) [@HilariousGil](https://discuss.elastic.co/u/HilariousGil)\
**Post date:** [December 5, 2017, 2:32pm UTC](https://discuss.elastic.co/t/multiple-indexes-created-instead-of-one/110348/3 "2017-12-05T14:32:14Z")

</div>

Our case consists in Indexing part of a database (that contains public and private data).  
Private data should never be indexed (the privacy of the data is mutable, so something that was once private can now be public and vice-versa).

So the Index is fully built (Less than 2000 documents total) every 30 min and then swapped with the old one using alias.  
And in this sense my naming of the index contains the minutes to separate the indexes built in the same hour.

I see that there is not a straightforward answer for this, therefore we are likely to decrease the "refresh rate" of the index to 1 hour, avoiding this problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2018, 2:32pm UTC](https://discuss.elastic.co/t/multiple-indexes-created-instead-of-one/110348/4 "2018-01-02T14:32:35Z")

</div>

Closed on January 2, 2018, 2:32pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.