# Newbie needs help: Logstash always creates index with a default name "logstash-xxxx.xx.xx"

**URL:** https://discuss.elastic.co/t/newbie-needs-help-logstash-always-creates-index-with-a-default-name-logstash-xxxx-xx-xx/19860
**Category:** Elasticsearch
**Created:** [September 18, 2014, 9:00am UTC](https://discuss.elastic.co/t/newbie-needs-help-logstash-always-creates-index-with-a-default-name-logstash-xxxx-xx-xx/19860 "2014-09-18T09:00:19Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![hpniemitube](https://avatars.discourse-cdn.com/v4/letter/h/ce7236/32.png) [@hpniemitube](https://discuss.elastic.co/u/hpniemitube)
#### Post date: [September 18, 2014, 9:00am UTC](https://discuss.elastic.co/t/newbie-needs-help-logstash-always-creates-index-with-a-default-name-logstash-xxxx-xx-xx/19860/1 "2014-09-18T09:00:19Z")

</div>

Hi,

Havn't been using ELK too long and I just can't undestand, why always  
logstash creates new index with the default name "logstash-xxxx.xx.xx" and  
ignores totally my config. I have tried to tell:

index =\> "api-%{+YYYY.MM.dd}"

... or just "api" or anything, but it always creates the index with the  
default name. Why? I would like to get a situation where logstash creates a  
daily index like now but with the name "api-xxx.xx.xx" and not the default.  
What am I missing?

Thanks very many.

Config:

## cat input\_syslog.conf

input {  
syslog {  
port =\> 514  
type =\> "syslog"  
}  
}

## cat /output\_elasticsearch.conf

# 

output {  
elasticsearch\_http {  
host =\> "localhost"  
index =\> "api-%{+YYYY.MM.dd}"  
manage\_template =\> false  
template\_overwrite =\> true

}  
}

I have created a template "apitemplate\_1" and elastic is using it, every  
time logstash creates a daily index, there is 3 shards and 2 replicas so at  
least somehow my template is in use:

{  
"template" : "_",  
"settings" : {  
"index.refresh\_interval" : "5s",  
"number\_of\_shards" : 3,  
"number\_of\_replicas" : 2  
},  
"mappings" : {  
"default" : {  
"\_all" : {"enabled" : true},  
"dynamic\_templates" : [ {  
"string\_fields" : {  
"match" : "_",  
"match\_mapping\_type" : "string",  
"mapping" : {  
"type" : "string", "index" : "analyzed", "omit\_norms" : true,  
"fields" : {  
"raw" : {"type": "string", "index" : "not\_analyzed", "ignore\_above" : 256}  
}  
}  
}  
} ],  
"properties" : {  
"@version": { "type": "string", "index": "not\_analyzed" },  
"geoip" : {  
"type" : "object",  
"dynamic": true,  
"path": "full",  
"properties" : {  
"location" : { "type" : "geo\_point" }  
}  
}  
}  
}  
}  
}

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/676bb8b3-3e8c-457b-a3a0-88eb7bc58b75%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/676bb8b3-3e8c-457b-a3a0-88eb7bc58b75%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:01am UTC](https://discuss.elastic.co/t/newbie-needs-help-logstash-always-creates-index-with-a-default-name-logstash-xxxx-xx-xx/19860/2 "2017-07-06T01:01:22Z")

</div>