# Wrong indexing if log is set to DEBUG

**URL:** <https://discuss.elastic.co/t/wrong-indexing-if-log-is-set-to-debug/114831>\
**Category:** Logstash\
**Created:** [January 10, 2018, 10:23am UTC](https://discuss.elastic.co/t/wrong-indexing-if-log-is-set-to-debug/114831 "2018-01-10T10:23:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbampa](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@sbampa](https://discuss.elastic.co/u/sbampa)\
**Post date:** [January 10, 2018, 10:23am UTC](https://discuss.elastic.co/t/wrong-indexing-if-log-is-set-to-debug/114831/1 "2018-01-10T10:23:14Z")

</div>

Hi all, i have a jboss that produces logs as follow:  
[2018-01-10 00:01:03,032 DEBUG] [csmf\_37803-8AD3F44ACA4061B5F48ADF6851B4937E] [com.notio.report.web.ReportServlet] GetRemoteHost: 172.16.32.6  
[2018-01-10 00:01:04,469 DEBUG] [csmf\_37803-8AD3F44ACA4061B5F48ADF6851B4937E] [com.notio.report.web.ReportServlet] Referer: [http://172.16.32.20:8080/backoffice/report?action=terminal\_cash](http://172.16.32.20:8080/backoffice/report?action=terminal_cash)  
[2018-01-10 00:01:04,469 DEBUG] [csmf\_37803-8AD3F44ACA4061B5F48ADF6851B4937E] [com.notio.report.web.ReportServlet] GetRemoteHost: 172.16.32.6  
[2018-01-10 00:01:04,469 INFO] [csmf\_37803-8AD3F44ACA4061B5F48ADF6851B4937E] [com.notio.report.facade.CsmfForLicenceFacade] Calling getCsmfList(37803) !  
[2018-01-10 00:01:04,469 DEBUG] [csmf\_37803-8AD3F44ACA4061B5F48ADF6851B4937E] [com.notio.back\_office.server.ejb.web.WebLayerEJB] Using ProviderDBPool  
[2018-01-10 00:01:04,469 INFO] [csmf\_37803-8AD3F44ACA4061B5F48ADF6851B4937E] [com.notio.back\_office.server.ejb.db.DBStargateEJB] query() called

Problem is that line with INFO severity go in the correct index, index-2018-01-10  
but line with DEBUG go every day in index-2018-01-01.

filebeat config:  
...  
multiline.pattern: '^['  
multiline.negate: true  
multiline.match: after  
filebeat.config.modules:  
path: ${path.config}/modules.d/\*.yml  
reload.enabled: false  
reload.period: 10s  
output.logstash:  
hosts: ["172.16.0.4:5043", "172.16.0.5:5043", "172.16.0.6:5043"]  
loadbalance: true  
compression\_level: 0  
username: "elastic"  
password: "changeme"

LS config:  
filter {  
grok {  
match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:level} "]  
match =\> ["message", "%{HTTPDERROR\_DATE:timestamp} (%{NUMBER:bytes}) "]  
match =\> ["message", "%{TIME:timestamp} %{LOGLEVEL:level}"]  
match =\> ["message", "%{BIND9\_TIMESTAMP:timestamp}"]  
}  
date {  
match =\> ["timestamp", "YYYY-MM-dd HH:mm:ss,SSS", "HH:mm:ss,SSS", "EEE MMM dd HH:mm:ss YYYY", "dd-MMM-yyyy HH:mm:ss.SSS"]  
timezone =\> "Europe/Rome"  
target =\> "@timestamp"  
}  
mutate {  
remove\_field =\> ["timestamp","offset","level","@version","input\_type","beat","type","tags","sort"]  
}

}  
...  
if [fields][log\_type] == "backoffice-agenzie"{  
elasticsearch {  
hosts =\> ["172.16.0.4:9200", "172.16.0.5:9200", "172.16.0.6:9200"]  
user =\> elastic  
password =\> "changeme"  
manage\_template =\> false  
index =\> "backoffice-agenzie-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"

Can somone help me?

---

<div class="post-metadata">

**Author:** ![murlin99](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@murlin99](https://discuss.elastic.co/u/murlin99)\
**Post date:** [January 10, 2018, 11:11am UTC](https://discuss.elastic.co/t/wrong-indexing-if-log-is-set-to-debug/114831/2 "2018-01-10T11:11:12Z")

</div>

This is a logstash question. Posting this to the logstash group will give a better chance of getting an answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2018, 11:11am UTC](https://discuss.elastic.co/t/wrong-indexing-if-log-is-set-to-debug/114831/3 "2018-02-07T11:11:16Z")

</div>

Closed on February 7, 2018, 11:11am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.