# Add multiple types in filebeat for logstash output

**URL:** <https://discuss.elastic.co/t/add-multiple-types-in-filebeat-for-logstash-output/121909>\
**Category:** Logstash\
**Created:** [February 28, 2018, 5:37pm UTC](https://discuss.elastic.co/t/add-multiple-types-in-filebeat-for-logstash-output/121909 "2018-02-28T17:37:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)\
**Post date:** [February 28, 2018, 5:37pm UTC](https://discuss.elastic.co/t/add-multiple-types-in-filebeat-for-logstash-output/121909/1 "2018-02-28T17:37:35Z")

</div>

Is there a way I can have multiple types with filebeat and logstash? I have multiple app logs I want to send to different indices. BUT they will be processed the same way

I want to do something like this:

```
filebeat.prospectors:
- type: iis,app01
  paths:
    - /c:/intepub/app01

- type: iis,app02
  paths:
    - /c:/intepub/app02

  fields_under_root: true

```

And then in logstash something like this:

```
input {
  tcp {
    type => "iis"
    port => "9999"
  }
}

filter {
  if [type] == "iis" {
  ...process iis logs....
  }
}

output {
  if [type] == "app01" {
    elasticsearch {
      hosts => "${ES_CLUSTER}"
      index => "logstash-APP01-%{+YYYY-MM-dd}"
    }
  }
  if [type] == "app02" {
    elasticsearch {
      hosts => "${ES_CLUSTER}"
      index => "logstash-APP02-%{+YYYY-MM-dd}"
    }
  }
}

```

Is this possible or I'm I going about this the wrong way?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 28, 2018, 5:48pm UTC](https://discuss.elastic.co/t/add-multiple-types-in-filebeat-for-logstash-output/121909/2 "2018-02-28T17:48:07Z")

</div>

Yes, you can do this. You can add tags (or fields) in the [prospector configuration](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html) and make everything in the logstash configuration conditional upon what tags the event has (or the value of some field, if you want to add a field in filebeat).

---

<div class="post-metadata">

**Author:** ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)\
**Post date:** [February 28, 2018, 5:57pm UTC](https://discuss.elastic.co/t/add-multiple-types-in-filebeat-for-logstash-output/121909/3 "2018-02-28T17:57:31Z")

</div>

But then I would have to modify the grok config right?

So in filebeat I could do this:

```
filebeat.prospectors:
- type: iis
  paths:
    - /c:/intepub/app01
fields:
  app_id: app01

- type: iis
  paths:
    - /c:/intepub/app02
fields:
  app_id: app02

  fields_under_root: true

```

But then does that field make my log line different?

Right now I have a big grok line:

```
grok {
  match => { "message" => "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:serviceName} ...etc }
}

```

These filebeat fields don't mess up my grok do they? Can I just referent them in the output somehow like this:

```
output {
  if [app_id] == "app01" {
    elasticsearch {
      hosts => "${ES_CLUSTER}"
      index => "logstash-APP01-%{+YYYY-MM-dd}"
    }
  }

```

Actually is there a way I could reference the field like this, this would be even better:

```
output {
    elasticsearch {
      hosts => "${ES_CLUSTER}"
      index => "logstash-{app_id}-%{+YYYY-MM-dd}"
    }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 28, 2018, 6:01pm UTC](https://discuss.elastic.co/t/add-multiple-types-in-filebeat-for-logstash-output/121909/4 "2018-02-28T18:01:18Z")

</div>

> [@red888](#):
>
> But then I would have to modify the grok config right?

No. Filebeat puts the line from the file in the event field message. It then adds the additional fields or tags that you configured. They are attached as fields or tags, they do not modify the message field.

I believe the "even better" substitution would work if you use a %{} reference.

```auto
index => "logstash-%{app_id}-%{+YYYY-MM-dd}"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2018, 6:01pm UTC](https://discuss.elastic.co/t/add-multiple-types-in-filebeat-for-logstash-output/121909/5 "2018-03-28T18:01:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.