# Set up index for fields created with logstash

**URL:** <https://discuss.elastic.co/t/set-up-index-for-fields-created-with-logstash/144741>\
**Category:** Logstash\
**Created:** [August 16, 2018, 3:24pm UTC](https://discuss.elastic.co/t/set-up-index-for-fields-created-with-logstash/144741 "2018-08-16T15:24:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ludovic9](https://avatars.discourse-cdn.com/v4/letter/l/977dab/32.png) [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\
**Post date:** [August 16, 2018, 3:24pm UTC](https://discuss.elastic.co/t/set-up-index-for-fields-created-with-logstash/144741/1 "2018-08-16T15:24:28Z")

</div>

Hello,  
I have a windows server with filebeat who analyzes a log generated by filezilla server.  
I send to the logstash server in order to add some fields (message, action, user, ...) then I send to elasticsearch.

I see my data in kibana but I can't search by the field I have created.  
I see 2 messages :

1. no cached mapping for this field. Refresh field list from the management =\> index patterns page

It's OK for this

1. : unindexed fields can not be searched.

How I can do that ?

Here my configuration of logstash :

```
input {
    beats {
    port => 5044
    }
  }

filter {

    grok {
     match => { "message" => "\(%{GREEDYDATA:id_filezilla}\) %{DATESTAMP:date_filezilla} - %{GREEDYDATA:compte_filezilla} \(%{IPV4:adresseip_filezilla}\)> %{GREEDYDATA:action_filezilla}" }
    }

    grok {
     match => { "message" => "\(%{GREEDYDATA:id_filezilla}\) %{DATESTAMP:date_filezilla} - \(%{GREEDYDATA:compte_filezilla}\) \(%{IPV4:adresseip_filezilla}\)> %{GREEDYDATA:action_filezilla}" }
    }

}

output {
    elasticsearch {
    hosts => "XXXX:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    }
}

```

Is something is missing ?

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![Ludovic9](https://avatars.discourse-cdn.com/v4/letter/l/977dab/32.png) [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\
**Post date:** [August 17, 2018, 10:25am UTC](https://discuss.elastic.co/t/set-up-index-for-fields-created-with-logstash/144741/2 "2018-08-17T10:25:27Z")

</div>

problem solved,  
to do this, you have to go in "index patterns page" then, in each filebeat indexed, refresh the field list.

By default, I was in winlogbeat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2018, 10:25am UTC](https://discuss.elastic.co/t/set-up-index-for-fields-created-with-logstash/144741/3 "2018-09-14T10:25:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.