# Can i send different Logs to different Indicies?

**URL:** <https://discuss.elastic.co/t/can-i-send-different-logs-to-different-indicies/222027>\
**Category:** Logstash\
**Created:** [March 4, 2020, 9:37am UTC](https://discuss.elastic.co/t/can-i-send-different-logs-to-different-indicies/222027 "2020-03-04T09:37:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [March 4, 2020, 9:37am UTC](https://discuss.elastic.co/t/can-i-send-different-logs-to-different-indicies/222027/1 "2020-03-04T09:37:02Z")

</div>

Hello Community,  
by now, my config file for incoming Logs looks like this:

```
input {
  udp {
    port => 5140
    type => syslog
  }
}

filter {
  syslog_pri { }
  date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  if [message] =~ /devname=/ {
    kv {
      source => "message"
    }
    mutate {
        convert => { "cpu" => "integer" }
        convert => { "mem" => "integer" }
        convert => { "disk" => "integer" }
        convert => { "totalsession" => "integer" }
        rename => { "type" => "fgt_type" }
        rename => { "subtype" => "fgt_subtype" }
        add_field => ["type", "syslog"]
        add_field => ["fortilog", 1]
        lowercase => ["vd"]
   }
  }
  if [message] =~ /-esx-/ {
    if [message] =~ /^\S+ \S+ \S+ \S+: \S+ \S+ \[Originator@\d+ [^]]+\] .*$/
    {
      grok {
        match => ["message", "\S+ \S+ (?<syslog_hostname>\S+) (?<esxservice>\S+): (?<level>\S+) (?<esxprocess>\S+) \[Originator@\d+ (?<esxsubinfo>[^]]+)\] (?<esxmessage>.*)" ]
      }
      kv {
        source=>"esxsubinfo"
      }
    }
    else {
      grok {
        match => ["message", "^\S+ \S+ (?<syslog_hostname>\S+) (?<esxservice>\S+): (?<esxservicemessage>.*)$"]
      }
    }
  }

}

output {
    if [type] == "syslog" {
      elasticsearch {
        hosts => ["X.X.X.X:XXXX"]
        index => "logstash"
  }
  }
}

```

If i now want to send the logs, which recieve the file "fortilog : 1", to a different indicie how can i manage that?  
I've tried to to something like this ;

```
if [fortilog] == "1" {
  elasticsearch {
    hosts => ["X.X.X.X:XXXX"]
    index => "SampleIndex1"
}
}
   else 
   elasticsearch {
        hosts => ["X.X.X.X:XXXX"]
        index => "SampleIndex2"
}
}
}

```

But this does not seem to work, as i'm not able to create index pattern even if i create the index manually.

Any ideas?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2020, 9:37am UTC](https://discuss.elastic.co/t/can-i-send-different-logs-to-different-indicies/222027/2 "2020-04-01T09:37:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.