# Best practices configuring indexes to periodic logs **URL:** \ **Category:** Logstash\ **Created:** [April 5, 2016, 12:48pm UTC](https://discuss.elastic.co/t/best-practices-configuring-indexes-to-periodic-logs/46392 "2016-04-05T12:48:05Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![nlhedder](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@nlhedder](https://discuss.elastic.co/u/nlhedder)\ **Post date:** [April 5, 2016, 12:48pm UTC](https://discuss.elastic.co/t/best-practices-configuring-indexes-to-periodic-logs/46392/1 "2016-04-05T12:48:05Z")
Not sure if my search on the forum is correct (many hits on searchin in Indexes, so I'll try to post my question here: We have several servers /switches/appliances which I would like to pull the logging into ELK. This is fairly straightforward and currently working nicely. But, I would like to know the best way to configure which log from which server is going into one of the folllowing indexes/Indices: weekly monthly yearly indefinate This will also be my cleanup schedule. By default into weekly (debugging/testing purpases) And then if need be into one of the others. I am under the impression, that this can be configured in multiple ways, but I cannot imagine I am the only one tryingh to do this, so is there any information on this? I tried to add filebeat as part of that cahin, but I didn't get it to work and I also have switches and appliances which do not have this option, so it would mean different type of configurations, which I am trying to avoid. Is this something better to be configured in the output only, or it it better to use a combination of the filter and output configurations. My idea, is to use only the output where I can possibly decide by server/log to which index I want to store the logs, but I may get into a situation, where Apache log from server A is 1 week and from server B is 1 month, But the syslog from these 2 servers need to bee a year for example. Hopefully this makes any sense. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 5, 2016, 10:30pm UTC](https://discuss.elastic.co/t/best-practices-configuring-indexes-to-periodic-logs/46392/2 "2016-04-05T22:30:02Z")
> [@nlhedder](#): > > weekly > monthly Depends on your volume, but weekly seems logical. > [@nlhedder](#): > > yearly No. > [@nlhedder](#): > > indefinate Never. ---
**Author:** ![nlhedder](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@nlhedder](https://discuss.elastic.co/u/nlhedder)\ **Post date:** [April 6, 2016, 7:06am UTC](https://discuss.elastic.co/t/best-practices-configuring-indexes-to-periodic-logs/46392/3 "2016-04-06T07:06:27Z")
But what is the best way to configure this? To avoid complexity, it would be nice if you can decide which logfile from which source is going to which index with if...else statements. But I get the idea this is not possible. I cannot seem to find a good manual on this, or at least one, I can understand. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 6, 2016, 7:47am UTC](https://discuss.elastic.co/t/best-practices-configuring-indexes-to-periodic-logs/46392/4 "2016-04-06T07:47:38Z")
> [@nlhedder](#): > > But what is the best way to configure this? Depends on your volumes and requirements. > [@nlhedder](#): > > To avoid complexity, it would be nice if you can decide which logfile from which source is going to which index with if...else statements. You can, using conditionals! ---
**Author:** ![nlhedder](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@nlhedder](https://discuss.elastic.co/u/nlhedder)\ **Post date:** [April 6, 2016, 8:20am UTC](https://discuss.elastic.co/t/best-practices-configuring-indexes-to-periodic-logs/46392/5 "2016-04-06T08:20:57Z")
Hi thanks for the confirmation, Would this be a combination of the filter plugin and output plugin, or can you do this simply in the output plugin conf.? Would this be a good startingpoint: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) This suggest using both the filter and the output. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 6, 2016, 9:04am UTC](https://discuss.elastic.co/t/best-practices-configuring-indexes-to-periodic-logs/46392/6 "2016-04-06T09:04:37Z")
You can do it in filters and output, yes. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/best-practices-configuring-indexes-to-periodic-logs/46392/7 "2017-07-06T05:03:36Z")
Closed on July 6, 2017, 5:03am UTC