# Wrong Index type set in Logstash

**URL:** <https://discuss.elastic.co/t/wrong-index-type-set-in-logstash/24708>\
**Category:** Logstash\
**Created:** [July 1, 2015, 10:17am UTC](https://discuss.elastic.co/t/wrong-index-type-set-in-logstash/24708 "2015-07-01T10:17:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [July 1, 2015, 10:17am UTC](https://discuss.elastic.co/t/wrong-index-type-set-in-logstash/24708/1 "2015-07-01T10:17:34Z")

</div>

Not sure , why my Index\_type is set to "json" even I haven't mention this anywhere in my config. Actually, my index\_type would be set to "test\_log" as per the forwarder config. But here, it set to "json". its weird.

Forwarder config:

"files": [  
{  
"paths": [  
"/var/log/test.log"  
],

```
  "fields": { **"type": "test_log"** }
}

```

]

Sample Logs:

2015-07-01 05:46:57,747 INFO 123456789 172.20.1.10 [test.example.com](http://test.example.com)  
2015-07-01 05:46:57,748 INFO 127.0.0.1 - - [01/Jul/2015 05:46:57] "GET /index.html HTTP/1.1" 200 354 0.001234

Logstash Stdout:  
{  
"message" =\> "2015-07-01 05:46:57,747 INFO 123456789 172.20.1.10 [test.example.com](http://test.example.com)",  
"@version" =\> "1",  
"@timestamp" =\> "2015-07-01T09:47:04.201Z",  
**"type" =\> "json",**  
"file" =\> "/var/log/test.log",  
"host" =\> "[test.example.com](http://test.example.com)",  
"offset" =\> "5766756"  
}  
{  
"message" =\> "2015-07-01 05:46:57,748 INFO 127.0.0.1 - - [01/Jul/2015 05:46:57] "GET /index.html HTTP/1.1" 200 354 0.001234",  
"@version" =\> "1",  
"@timestamp" =\> "2015-07-01T09:47:04.201Z",  
**"type" =\> "json"** ,  
"file" =\> "/var/log/test.log",  
"host" =\> "[test.example.com](http://test.example.com)",  
"offset" =\> "5766832"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 1, 2015, 10:27am UTC](https://discuss.elastic.co/t/wrong-index-type-set-in-logstash/24708/2 "2015-07-01T10:27:56Z")

</div>

What does Logstash's input block that receives the messages look like?

---

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [July 1, 2015, 10:44am UTC](https://discuss.elastic.co/t/wrong-index-type-set-in-logstash/24708/3 "2015-07-01T10:44:58Z")

</div>

this is my input block in logstash server config

lumberjack {  
port =\> 5043  
type =\> "logs"  
ssl\_certificate =\> "/etc/pki/tls/certs/test.example.com.crt"  
ssl\_key =\> "/etc/pki/tls/private/test.example.com.key"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/wrong-index-type-set-in-logstash/24708/4 "2017-07-06T05:35:51Z")

</div>