# Unable to create index with %{type} in logstash output

**URL:** https://discuss.elastic.co/t/unable-to-create-index-with-type-in-logstash-output/334079
**Category:** Beats
**Tags:** filebeat
**Created:** [May 23, 2023, 6:51am UTC](https://discuss.elastic.co/t/unable-to-create-index-with-type-in-logstash-output/334079 "2023-05-23T06:51:11Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)
#### Post date: [May 23, 2023, 6:51am UTC](https://discuss.elastic.co/t/unable-to-create-index-with-type-in-logstash-output/334079/1 "2023-05-23T06:51:11Z")

</div>

Hi here is my logstash config file

```auto
input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => "http://IP:9200"
    index => "%{type}%{+YYYY.MM.dd}"
    user => "elastic"
    password => "pwd"
  }
}

```

This is not creating the index. getting %{type} not compatible. if i remove {type} and put a string in its place it is creating the index. I tried putting %{[fields.type]} this is also giving me error

```auto
 elasticsearch - Badly formatted index, after interpolation still contains placeholder: [%{[fields.type]}2023.05.23];

```

What is the correct syntax. I am using 8.7 version of elk stack

---

<div class="post-metadata">

### Author: ![eMitch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emitch/32/93607_2.png) [@eMitch](https://discuss.elastic.co/u/eMitch)
#### Post date: [May 24, 2023, 1:11pm UTC](https://discuss.elastic.co/t/unable-to-create-index-with-type-in-logstash-output/334079/2 "2023-05-24T13:11:30Z")

</div>

Hi @Neelam_Zanvar.

Assuming you have the `type` field available, then it should be something closer to: `index => "%{[type]}%-{+YYYY.MM.dd}"`

see examples from here: [Writing to different indices: best practices](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#_writing_to_different_indices_best_practices)

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [May 24, 2023, 1:18pm UTC](https://discuss.elastic.co/t/unable-to-create-index-with-type-in-logstash-output/334079/3 "2023-05-24T13:18:10Z")

</div>

> [@Neelam\_Zanvar](#):
>
> What is the correct syntax

The syntax is correct as you can check in the [documentation](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf).

You need to make sure that you have the field you are referencing in your document.

Also, the correct way to reference nested fields in logstash is using `[field][nested]` and not `field.nested`, in this case you would need to use `[fields][type]`, not `[fields.type]`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 21, 2023, 3:18pm UTC](https://discuss.elastic.co/t/unable-to-create-index-with-type-in-logstash-output/334079/4 "2023-06-21T15:18:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.