WARN|INFO|DEBUG|ERROR|FATAL)\|%{GREEDYDATA:message}"
}
}
date {
match => ["log_date", "yyyy-MM-dd HH:mm:ss.SSS"]
timezone => "+01:00"
remove_field => ["log_date"]
}
}
output {
elasticsearch {
hosts => ["elastic:9201", "elastic:9202"]
}
}
```
Yes, I have 2 instances of ES on a single machine, but they use different directories. For some reason indices are not created daily I have 2 indices. Both created the 28th of December. New docs are added to the second one.
Does someone know what I did wrong?
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [January 15, 2020, 10:12am UTC](https://discuss.elastic.co/t/new-index-is-not-created/215091/2 "2020-01-15T10:12:13Z")
Hi
You can specify indices like this in your output
```auto
output {
elasticsearch {
hosts => ["elastic:9201", "elastic:9202"]
index = > "foobar"
}
}
```
You should reffer to : [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html)
if you want something daily you should try something like this
```auto
index = > "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
```
---
### Author:  [@Wojciech\_Gomola](https://discuss.elastic.co/u/Wojciech_Gomola)
#### Post date: [January 15, 2020, 12:29pm UTC](https://discuss.elastic.co/t/new-index-is-not-created/215091/3 "2020-01-15T12:29:06Z")
I don't wanna specify it manually. AFAIK default one should work as I expect. I suppose that it is related to ILM, for some reason, Logstash is not able to figure out the format.
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [January 15, 2020, 12:33pm UTC](https://discuss.elastic.co/t/new-index-is-not-created/215091/4 "2020-01-15T12:33:59Z")
Maybe, you should try logstash log level debug and see what's happening.
---
### Author:  [@Wojciech\_Gomola](https://discuss.elastic.co/u/Wojciech_Gomola)
#### Post date: [January 16, 2020, 2:11pm UTC](https://discuss.elastic.co/t/new-index-is-not-created/215091/5 "2020-01-16T14:11:20Z")
Nothing realy interesting. It uses default index. To be sure I dropped index template and LS recreated it. It still writes to old index.
```
[2020-01-16T14:16:46,488][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@index = "logstash-%{+YYYY.MM.dd}"
[2020-01-16T14:16:46,488][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@manage_template = true
[2020-01-16T14:16:46,489][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@template_name = "logstash"
[2020-01-16T14:16:46,489][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@template_overwrite = false
```
I have also added the second file output plugin and I see that timestamp is properly formatted. What date does the ES plugin use for index names?
Edit:
Logs related to ILM:
```
[2020-01-16T14:16:46,497][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@ilm_enabled = "auto"
[2020-01-16T14:16:46,497][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@ilm_rollover_alias = "logstash"
[2020-01-16T14:16:46,498][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@ilm_pattern = "{now/d}-000001"
[2020-01-16T14:16:46,498][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@ilm_policy = "logstash-policy"
```
---
### Author:  [@Wojciech\_Gomola](https://discuss.elastic.co/u/Wojciech_Gomola)
#### Post date: [January 16, 2020, 3:39pm UTC](https://discuss.elastic.co/t/new-index-is-not-created/215091/6 "2020-01-16T15:39:18Z")
I used custom index format and used lowercase y instead of uppercase and it fixed issue. Other peoples struggles with it also [Github](https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/876)
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [January 17, 2020, 8:56am UTC](https://discuss.elastic.co/t/new-index-is-not-created/215091/7 "2020-01-17T08:56:19Z")
Oh i forgot that, ineed no caps in index names
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2020, 8:56am UTC](https://discuss.elastic.co/t/new-index-is-not-created/215091/8 "2020-02-14T08:56:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.