# Problem creating index
**URL:** https://discuss.elastic.co/t/problem-creating-index/229454
**Category:** Beats
**Tags:** filebeat
**Created:** [April 23, 2020, 11:28am UTC](https://discuss.elastic.co/t/problem-creating-index/229454 "2020-04-23T11:28:19Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@vdelburgo](https://discuss.elastic.co/u/vdelburgo)
#### Post date: [April 23, 2020, 11:28am UTC](https://discuss.elastic.co/t/problem-creating-index/229454/1 "2020-04-23T11:28:19Z")
Good morning,
I have a filebeat on one server, and I would need you to create a new index, different from what I have configured on other servers, so that when the index is created the Kibana can absorb it under another name.
What I have configured in the `filebeat.yml` is the following:
```
output.logstash:
# The Logstash hosts
hosts: ["logstash.com:5044"]
index: "filebeat-MAXIMO_UP-%{+yyyy.MM.dd}"
```
And the logstash in the following way in the ELK server, so that it recognizes me the common indexes, and the one of the specific server that I have commented above, that later would be more servers. My `output-elasticsearch.conf` is the following:
```auto
output {
elasticsearch { hosts => ["logstash.com:9200"]
hosts => "logstash.com:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
index => "%{[@metadata][beat]}-MAXIMO_UP-%{+yyyy.MM.dd}"
}
}
```
But the logstash does not recognize it, when creating an index with Kibana it does not appear, where could it have the error?
Greetings and thanks
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [April 23, 2020, 2:54pm UTC](https://discuss.elastic.co/t/problem-creating-index/229454/2 "2020-04-23T14:54:50Z")
Hi @vdelburgo, welcome to the Elastic community forums!
It looks like you are specifying the `index` setting twice in your Logstash Elasticsearch output plugin.
```auto
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
index => "%{[@metadata][beat]}-MAXIMO_UP-%{+yyyy.MM.dd}"
```
I don't think this is supported. I'm not sure but I assume the plugin is only honoring one of those settings.
Instead, I think what you want is something like this:
```auto
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
```
When Beats send events to Logstash, each event contains a `@metadata` field. That field contains a `beat` field. By default the value of that field is the name of the Beat, e.g. `filebeat`. In your case, this field will contain the correct index name, depending on which Beat is sending the event.
Hope that makes sense.
Shaunak
---
### Author:  [@vdelburgo](https://discuss.elastic.co/u/vdelburgo)
#### Post date: [April 23, 2020, 3:12pm UTC](https://discuss.elastic.co/t/problem-creating-index/229454/3 "2020-04-23T15:12:09Z")
Hello Shaunak,
OK, I can prove it. But the question is if, for example, I have three servers that I want to group in the 'index1' and another 3 servers that I want to group in the 'index2' how do I make those groupings? I don't know if I can explain...
Thanks and regards
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [April 23, 2020, 6:27pm UTC](https://discuss.elastic.co/t/problem-creating-index/229454/4 "2020-04-23T18:27:42Z")
When you say "servers", you mean Filebeat instances, right? In that case, what you are doing by setting the desired index prefix under `output.logstash.index` is correct.
So for the first three Filebeat instances you would set `output.logstash.index: index1` and for the other 3 you would set `output.logstash.index: index2`.
Then in your Logstash pipeline's Elasticsearch output settings, you would set `index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"`. This will cause the data coming from your first three Filebeat instances to be indexed into `index1-2020.04.23` and data coming from your other three Filebeat instances to be indexed into `index2-2020.04.23` (assuming today's date just as an example).
---
### Author:  [@vdelburgo](https://discuss.elastic.co/u/vdelburgo)
#### Post date: [April 24, 2020, 7:05am UTC](https://discuss.elastic.co/t/problem-creating-index/229454/5 "2020-04-24T07:05:28Z")
Perfect Shaunak, it works for me...
Is there a way to create the indexes automatically in Kibana? I mean, so I don't have to click on 'create index' every day
Greetings and thank you very much for your help
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [April 24, 2020, 6:06pm UTC](https://discuss.elastic.co/t/problem-creating-index/229454/6 "2020-04-24T18:06:24Z")
> [@vdelburgo](#):
>
> Is there a way to create the indexes automatically in Kibana? I mean, so I don't have to click on 'create index' every day
Sorry, but I'm not quite sure what you mean by this. Kibana has the notion of [index patterns](https://www.elastic.co/guide/en/kibana/current/tutorial-define-index.html) to match multiple indices with wildcards. Perhaps that's what you're looking for?
---
### Author:  [@vdelburgo](https://discuss.elastic.co/u/vdelburgo)
#### Post date: [April 27, 2020, 8:01am UTC](https://discuss.elastic.co/t/problem-creating-index/229454/7 "2020-04-27T08:01:55Z")
Sorry, that was a silly question... 🙄
Thanks and regards for your help
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2020, 8:02am UTC](https://discuss.elastic.co/t/problem-creating-index/229454/8 "2020-05-25T08:02:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.