# 3 diferent index?

**URL:** https://discuss.elastic.co/t/3-diferent-index/184602
**Category:** Elasticsearch
**Created:** [June 6, 2019, 2:09pm UTC](https://discuss.elastic.co/t/3-diferent-index/184602 "2019-06-06T14:09:41Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![cgermanb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cgermanb/32/32285_2.png) [@cgermanb](https://discuss.elastic.co/u/cgermanb)
#### Post date: [June 6, 2019, 2:09pm UTC](https://discuss.elastic.co/t/3-diferent-index/184602/1 "2019-06-06T14:09:41Z")

</div>

Hi people,  
I have 3 elk for different logs, I want to make only one big elk but separate these logs. Can I do 3 different indices? How do I indicate the filebeat to which index should I send? Where can I read about this?

thanks

---

<div class="post-metadata">

### Author: ![gabriel\_tessier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel_tessier/32/27911_2.png) [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)
#### Post date: [June 7, 2019, 4:05am UTC](https://discuss.elastic.co/t/3-diferent-index/184602/2 "2019-06-07T04:05:02Z")

</div>

Hi,

> [@cgermanb](#):
>
> Where can I read about this?

Here:

> **[filebeat.reference.yml | Filebeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-reference-yml.html)**

You need to set the index in your filebeat.yml file under the output.elasticsearch key.

```
output.elasticsearch:
  # Boolean flag to enable or disable the output module.
  #enabled: true

  # Array of hosts to connect to.
  # Scheme and port can be left out and will be set to the default (http and 9200)
  # In case you specify and additional path, the scheme is required: http://localhost:9200/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:9200
  hosts: ["localhost:9200"]

  # Optional index name. The default is "filebeat" plus date
  # and generates [filebeat-]YYYY.MM.DD keys.
  # In case you modify this pattern you must update setup.template.name and setup.template.pattern accordingly.
  index: "project1-%{[agent.version]}-%{+yyyy.MM.dd}"

```

If you use a json syntaxe:

```
{
  "output.elasticsearch": {
    "hosts": [
      "localhost:9200"
    ],
    "index": "project1-%{+yyyy.MM.dd}"
  },

```

Just set the index name you want for each configuration and keep the same hosts and you are done.

Need to consider about the disk space, the network and CPU usage, be sure that your server can handle correctly 3 source input in same time.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2019, 4:05am UTC](https://discuss.elastic.co/t/3-diferent-index/184602/3 "2019-07-05T04:05:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
