# Prevent filebeat-version-yyyy-mm-dd index from ingesting

**URL:** <https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152>\
**Category:** Elasticsearch\
**Created:** [April 3, 2023, 5:41am UTC](https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152 "2023-04-03T05:41:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahul\_sirugudi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_sirugudi/32/94019_2.png) [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\
**Post date:** [April 3, 2023, 5:41am UTC](https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152/1 "2023-04-03T05:41:31Z")

</div>

On daily basis i am seeing indexes with name filebeat-7.17.7-yyyy-mm-dd are creating. This is eating lot of space i have to delete them manually.

1. I Have seen options like to create entry in ES which will not allow auto index =\> if i enable this then ILM will not work.

Is there any better option to stop this entirely?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 4, 2023, 1:39am UTC](https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152/2 "2023-04-04T01:39:02Z")

</div>

Can you stop them at the source?

---

<div class="post-metadata">

**Author:** ![rahul\_sirugudi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_sirugudi/32/94019_2.png) [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\
**Post date:** [April 5, 2023, 1:51am UTC](https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152/3 "2023-04-05T01:51:04Z")

</div>

actually i am not seeing anything about it on filebeat.yml file.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 5, 2023, 2:33am UTC](https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152/4 "2023-04-05T02:33:30Z")

</div>

> [@rahul\_sirugudi](#):
>
> actually i am not seeing anything about it on filebeat.yml file.

What does your `filebeat.yml` looks like?

Is this the only filebeat you have?

If you do not want the data you need to stop it in the source.

---

<div class="post-metadata">

**Author:** ![rahul\_sirugudi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_sirugudi/32/94019_2.png) [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\
**Post date:** [April 5, 2023, 9:59am UTC](https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152/5 "2023-04-05T09:59:19Z")

</div>

here is the file.

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*/*/*/*.log
  fields:
          type: demo_logs
# ---------------------------- Elasticsearch Output ----------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["ip:9200"]

# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
        hosts: ["ip:5044"]
# ================================= Processors =================================
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
  - drop_event:
          when:
                  contains:
                          message: INFO

```

rest of fields are commented out.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 5, 2023, 12:37pm UTC](https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152/6 "2023-04-05T12:37:09Z")

</div>

> [@rahul\_sirugudi](#):
>
> ```auto
> output.logstash:
> # The Logstash hosts
> hosts: ["ip:5044"]
> 
> ```

You are sending your logs to Logstash, so you need to look check and share your logstash configuration.

Also, you didn't say if you are running other filebeats or just this one.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2023, 12:37pm UTC](https://discuss.elastic.co/t/prevent-filebeat-version-yyyy-mm-dd-index-from-ingesting/329152/7 "2023-05-03T12:37:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.