Filebeat is not creating my custom index? - filebeat

Question

I hope everyone is doing well.
I am using filebeat to ship cisco syslog (with using filebeat cisco module) to elasticsearch. And apparently it is not using my custom index, instead logs go to default index filebeat-*.
Note: the field host.name is a custom field.
-also tried disabling and enabling ILM but no luck.
Below is my filebeat.yml config:
# ============================== Filebeat inputs ===============================
filebeat.inputs:
- type: filestream
id: my-filestream-id
enabled: false
paths:
- /var/log/*.log
#- c:\programdata\elasticsearch\logs\*
- type: syslog
enabled: false
paths:
- /var/log/*.log
# ============================== Filebeat modules ==============================
filebeat.config.modules:
# Glob pattern for configuration loading
path: ${path.config}/modules.d/*.yml
# Set to true to enable config reloading
reload.enabled: false
# ======================= Elasticsearch template setting =======================
setup.template.overwrite: true
setup.template.settings:
index.number_of_shards: 1
# =================================== Kibana ===================================
setup.kibana:
host: "http://172.30.169.50:5000"
ssl.verification_mode: "none"
username: "elastic"
password: "m4gN3s1#.123"
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["172.30.169.50:9200"]
ssl.verification_mode: "none"
username: "elastic"
password: "secret"
indices:
- index: "sbx-%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "SBX"
- index: "core-%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "-CS0"
- index: "access%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "-AS0"
- index: "bgp-%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "RTRBGP"
- index: "iplc-%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "IPLC0"
- index: "asp-%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "ASP0"
- index: "sfs-%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "SFS0"
- index: "Local_Loop-%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "LL0"
- index: "mpls-%{+yyyy.MM.dd}"
when.contains:
fields:
host.name: "MPLS"
- index: "fortinet-%{+yyyy.MM.dd}"
when.contains:
fields:
event.module: "fortinet"
# ================================= Processors =================================
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
- drop_fields:
when:
equals:
event.module: "cisco"
fields: ["agent.ephemeral_id","agent.hostname","agent.id","agent.type","agent.version","agent.name","cisco.ios.facility","ecs.version","event.cod>
- drop_fields:
when:
equals:
event.module: "fortinet"
fields: ["agent.ephemeral_id","agent.hostname","agent.id","agent.type","agent.version","agent.name","ecs.version","event.code","event.dataset","e>
- dissect:
when:
equals:
event.module: "cisco"
tokenizer: "%{address}:%{}"
field: "log.source.address"
target_prefix: "host"
- dissect:
when:
equals:
event.module: "cisco"
tokenizer: "%{} %{name} %{}"
field: "log.original"
target_prefix: "host"