# Assistance with multiple syslogs and creating multiple indexes

**URL:** <https://discuss.elastic.co/t/assistance-with-multiple-syslogs-and-creating-multiple-indexes/174406>\
**Category:** Logstash\
**Created:** [March 28, 2019, 6:24pm UTC](https://discuss.elastic.co/t/assistance-with-multiple-syslogs-and-creating-multiple-indexes/174406 "2019-03-28T18:24:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![FrostyDLL](https://avatars.discourse-cdn.com/v4/letter/f/9fc29f/32.png) [@FrostyDLL](https://discuss.elastic.co/u/FrostyDLL)\
**Post date:** [March 28, 2019, 6:24pm UTC](https://discuss.elastic.co/t/assistance-with-multiple-syslogs-and-creating-multiple-indexes/174406/1 "2019-03-28T18:24:05Z")

</div>

Hi Everyone,

I have an issue that many have probably encountered before. I have a server "DATA-MGT" that collects data from other systems, and formats that information as a custom SYSLOG file.

With FileBeats installed on the DATA-MGT, we are Sending different syslogs to our Logstash i'm trying to figure out if a index can be named after the document type.  
I understand that logstash has a filter based on **if [type] == "name\_of\_document\_type"**  
wasn't sure if that could be applied to to output section as well, in my tests they have not resulted well.

Here is the config files i have, i'm new to YAML and this forum, please let me know if the "blockquote" is the best way to post the sample config files.

Filebeat.yml:

> ################################
> 
> filebeat.inputs:
> 
> - type: log  
> enabled: true  
> paths:
> - C:\Temp\Logs\1\*.log  
> document\_type: Log1
> 
> - type: log  
> enabled: true  
> paths:
> - C:\Temp\Logs\2\*.log  
> document\_type: Log2
> 
> - type: log  
> enabled: true  
> paths:
> - C:\Temp\Logs\3\*.log  
> document\_type: Log3
> 
> - type: log  
> enabled: true  
> paths:
> - C:\Temp\Logs\4\*.log  
> document\_type: Log4
> 
> filebeat.config.modules:  
> path: ${path.config}/modules.d/\*.yml
> 
> reload.enabled: false
> 
> setup.template.settings:  
> index.number\_of\_shards: 3
> 
> output.logstash:  
> hosts: ["ELK-K:5044"]
> 
> processors:
> 
> - add\_host\_metadata: ~
> - add\_cloud\_metadata: ~  
> ################################

Logstash.conf

> ################################  
> input {  
> beats {  
> client\_inactivity\_timeout =\> 1200  
> port =\> 5044  
> }  
> }
> 
> filter {  
> if [type] == "Log1" {  
> csv {  
> separator =\> ","  
> columns =\> ["Item1","Item2","Item3","Item4","Item5","Item6"]  
> convert =\> {  
> "Item4" =\> "float"  
> "Item5" =\> "float"  
> "Item6" =\> "float"  
> }  
> }  
> date {  
> match =\> ["Item1" , "YYYY-MM-dd'T'HH:mm:ss.SSSZZZ"]  
> target =\> "timestamp"  
> }  
> }  
> if [type] == "Log2" {  
> csv {  
> separator =\> ","  
> columns =\> ["Item1","Item2","Item3"]  
> }  
> date {  
> match =\> ["Item1" , "YYYY-MM-dd'T'HH:mm:ss.SSSZZZ"]  
> target =\> "timestamp"  
> }  
> }  
> if [type] == "Log3" {  
> csv {  
> separator =\> ","  
> columns =\> ["Item1","Item2","Item3","Item4"]  
> }  
> date {  
> match =\> ["Item1" , "YYYY-MM-dd'T'HH:mm:ss.SSSZZZ"]  
> target =\> "timestamp"  
> }  
> }  
> if [type] == "Log4" {  
> csv {  
> separator =\> ","  
> columns =\> ["Item1","Item2","Item3","Item4"]  
> convert =\> {  
> "Item4" =\> "integer"  
> }  
> }  
> date {  
> match =\> ["Item1" , "YYYY-MM-dd'T'HH:mm:ss.SSSZZZ"]  
> target =\> "timestamp"  
> }  
> }  
> }
> 
> output {  
> if [type] == "Log1" {  
> elasticsearch {  
> hosts =\> ["[http://ELK-E:9200](http://ELK-E:9200)"]  
> index =\> "Log1-%{+YYYY.MM.dd}"  
> }  
> }  
> if [type] == "Log2" {  
> elasticsearch {  
> hosts =\> ["[http://ELK-E:9200](http://ELK-E:9200)"]  
> index =\> "Log2-%{+YYYY.MM.dd}"  
> }  
> }  
> if [type] == "Log3" {  
> elasticsearch {  
> hosts =\> ["[http://ELK-E:9200](http://ELK-E:9200)"]  
> index =\> "Log3-%{+YYYY.MM.dd}"  
> }  
> }  
> if [type] == "Log4" {  
> elasticsearch {  
> hosts =\> ["[http://ELK-E:9200](http://ELK-E:9200)"]  
> index =\> "Log4-%{+YYYY.MM.dd}"  
> }  
> }  
> }  
> ################################

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 28, 2019, 6:58pm UTC](https://discuss.elastic.co/t/assistance-with-multiple-syslogs-and-creating-multiple-indexes/174406/2 "2019-03-28T18:58:33Z")

</div>

> [@FrostyDLL](#):
>
> please let me know if the "blockquote" is the best way to post the sample config files.

That's fine.

Not sure about the current version but in the past document\_type did set the type field and then your conditional logic for both filters and outputs looks OK. I suggest adding either a file or stdout output with { codec =\> rubydebug } and look at what is actually on the events that arrive.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2019, 6:58pm UTC](https://discuss.elastic.co/t/assistance-with-multiple-syslogs-and-creating-multiple-indexes/174406/3 "2019-04-25T18:58:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.