# Zeek input only creating index templates and system indices

**URL:** <https://discuss.elastic.co/t/zeek-input-only-creating-index-templates-and-system-indices/218253>\
**Category:** Elasticsearch\
**Created:** [February 6, 2020, 11:02pm UTC](https://discuss.elastic.co/t/zeek-input-only-creating-index-templates-and-system-indices/218253 "2020-02-06T23:02:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Junebee](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Junebee](https://discuss.elastic.co/u/Junebee)\
**Post date:** [February 6, 2020, 11:02pm UTC](https://discuss.elastic.co/t/zeek-input-only-creating-index-templates-and-system-indices/218253/1 "2020-02-06T23:02:51Z")

</div>

I am trying to ingest data from a Zeek sensor directly into Elasticsearch and when I do ES creates index templates and system indices for each Zeek log but no usable indices. This is from a clean instance but this result occurs regardless of if I have pipelines installed. This is a basic single node setup with pretty low data rate.

 ![No indices](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c719426fca81110ba345e015a0bf81a2c22f3391.png)  
 ![Index Templates](https://us1.discourse-cdn.com/elastic/original/3X/1/9/19b3bc29925081b79b498121771d165c06659f89.png)  
 ![System indices](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f2a0f6ca8188eb41df9f59a4a1a7034a66ad7f3c.png)

The template indices all list the appropriate index alias. I.e. bro-conn-1343215431254 has an alias bro-conn.

The reason why I'm trying to go directly to ES vice using Logstash is because when I use ingest pipelines with Logstash my resource usage is unsustainable - though it works.

I have searched around and am not seeing this issue anywhere so thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 5, 2020, 11:02pm UTC](https://discuss.elastic.co/t/zeek-input-only-creating-index-templates-and-system-indices/218253/2 "2020-03-05T23:02:51Z")

</div>

Closed on March 5, 2020, 11:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.