# Stop logstash from automatically creating an index on elastic
**URL:** https://discuss.elastic.co/t/stop-logstash-from-automatically-creating-an-index-on-elastic/306555
**Category:** Logstash
**Created:** [June 7, 2022, 11:16am UTC](https://discuss.elastic.co/t/stop-logstash-from-automatically-creating-an-index-on-elastic/306555 "2022-06-07T11:16:08Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)
#### Post date: [June 7, 2022, 11:16am UTC](https://discuss.elastic.co/t/stop-logstash-from-automatically-creating-an-index-on-elastic/306555/1 "2022-06-07T11:16:08Z")
Hello,
Is there a way to stop logstash from automatically creating an index in Elasticsearch. even if the conf file does not contain any configuration regarding the index.
Logstash logs:
```auto
logstash | [WARN] 2022-06-07 09:21:17.045 [[main]>worker6] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["create", {:_id=>nil, :_index=>"logs-cisco_asa.log", :routing=>nil},
```
The index now is closed because I cannot delete it:
Logstash conf file
```auto
Output {
else if [type] == "syslog" {
elasticsearch {
hosts => ["https://X.X.X.X:9200","https://X.X.X.X:9200","https://X.X.X.X:9200"]
cacert => 'XXXXXXX’
user => "XXX"
password => “xxxx"
data_stream => true
data_stream_type => "logs"
data_stream_dataset => "asa"
data_stream_namespace => "prod"
}
}
}
```
---
### Author:  [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)
#### Post date: [June 7, 2022, 11:19am UTC](https://discuss.elastic.co/t/stop-logstash-from-automatically-creating-an-index-on-elastic/306555/2 "2022-06-07T11:19:56Z")
the logs-cisco\_asa.log index is automatically being created even if after the output configuration is changed.
the purpose was to move syslog from legacy index to datastream.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2022, 11:20am UTC](https://discuss.elastic.co/t/stop-logstash-from-automatically-creating-an-index-on-elastic/306555/3 "2022-07-05T11:20:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.