# Problem with creation indexes based on custom field
**URL:** https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621
**Category:** Logstash
**Created:** [September 6, 2017, 6:01pm UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621 "2017-09-06T18:01:37Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@alex\_gorb](https://discuss.elastic.co/u/alex_gorb)
#### Post date: [September 6, 2017, 6:01pm UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621/1 "2017-09-06T18:01:37Z")
Hi,
I am using ELK 5.5.2.
I have a problem with creation indexes.
On filebeat config I have a following setup
- input\_type: log
document\_type: prod
paths:
On logstash config I have
elasticsearch {
hosts =\> "localhost:9200"
manage\_template =\> false
index =\> "%{[my\_log\_type]}-%{+YYYY.MM.dd}"
}
On 2 instances of ELK 5.5.2 this config is working fine, generating index with name app-2017-09-06
On 1 instance this config is generating index - %{[my\_log\_type]}-2017-09-06
What is wrong with this configuration?
Thank you.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 7, 2017, 5:35am UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621/2 "2017-09-07T05:35:59Z")
> On 1 instance this config is generating index - %{[my\_log\_type]}-2017-09-06
That indicates that the events ending up in that index don't have a `my_log_type` field.
---
### Author:  [@alex\_gorb](https://discuss.elastic.co/u/alex_gorb)
#### Post date: [September 7, 2017, 6:17am UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621/3 "2017-09-07T06:17:44Z")
Hi.
But I have only one filebeat prospector on this ELK instance and I see this field in the logstash log message.
Thank you.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 7, 2017, 7:17am UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621/4 "2017-09-07T07:17:13Z")
Please show a raw event from that index. Copy/paste from Kibana's JSON tab.
---
### Author:  [@alex\_gorb](https://discuss.elastic.co/u/alex_gorb)
#### Post date: [September 7, 2017, 9:04am UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621/5 "2017-09-07T09:04:26Z")
{
"\_index": "%{[my\_log\_type]}-2017.09.07",
"\_type": "log",
"\_id": "AV5bTV6bnAhJx1DJGWW-",
"\_version": 1,
"\_score": null,
"\_source": {
"@timestamp": "2017-09-07T07:45:45.352Z",
"offset": 408517,
"@version": "1",
"input\_type": "log",
"beat": {
"hostname": "XXXX",
"name": "XXXX",
"version": "5.5.2"
},
"host": "XXXX",
"source": "d:\somepath\Service-2017-09-07.log",
"type": "log",
"fields": {
"my\_log\_type": "app"
},
"tags": [
"beats\_input\_codec\_plain\_applied"
]
},
"fields": {
"@timestamp": [
1504770345352
]
},
"sort": [
1504770345352
]
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 7, 2017, 9:46am UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621/6 "2017-09-07T09:46:34Z")
But you don't have a `my_log_type` field (only `[fields][my_log_type]`). Look into Filebeat's `fields_under_root` option.
---
### Author:  [@alex\_gorb](https://discuss.elastic.co/u/alex_gorb)
#### Post date: [September 7, 2017, 10:02am UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621/7 "2017-09-07T10:02:19Z")
Thank you very much!
It is working now.
Best regards,
Alex.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 5, 2017, 10:02am UTC](https://discuss.elastic.co/t/problem-with-creation-indexes-based-on-custom-field/99621/8 "2017-10-05T10:02:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.