# Can we send logs to different outputs depending on filename they come from?
**URL:** https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815
**Category:** Logstash
**Created:** [July 30, 2019, 3:58am UTC](https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815 "2019-07-30T03:58:36Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@RITZ\_VERMA](https://discuss.elastic.co/u/RITZ_VERMA)
#### Post date: [July 30, 2019, 3:58am UTC](https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815/1 "2019-07-30T03:58:36Z")
in logstash i am trying to send logs from different files to different elasticsearch depending on their filename. is this possible?
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [July 30, 2019, 12:20pm UTC](https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815/2 "2019-07-30T12:20:33Z")
Sure
```
output {
if {
elasticsearch {..first target..}
} else {
elasticsearch {..other target..}
}
}
```
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [July 30, 2019, 2:14pm UTC](https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815/3 "2019-07-30T14:14:28Z")
@RITZ_VERMA
Do you mean a different cluster or a different index in the same cluster?
---
### Author:  [@RITZ\_VERMA](https://discuss.elastic.co/u/RITZ_VERMA)
#### Post date: [July 30, 2019, 5:50pm UTC](https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815/4 "2019-07-30T17:50:23Z")
In the same elastic cluster but on different indexes.i figured it out thanks
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [July 31, 2019, 8:22am UTC](https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815/5 "2019-07-31T08:22:08Z")
Did you figure out that the [**`index`** setting can be interpolated from values](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index) held in the event itself?
This eliminates the logic in the output section.
From this:
```auto
if [es_sub_index_] == "metrics" {
elasticsearch { index => "app_metrics" }
} else {
elasticsearch { index => "app_logs" }
}
```
to:
```auto
elasticsearch { index => "app_%{es_sub_index}" ... }
```
You will still need some logic in the filter section to add a value to a field called `es_sub_index` but using interpolation means that the communication with ES will not be broken into smaller chunks that are less efficient. The full batch will be sent to ES in one REST call and the body contains the divisions. In English, something like "In this index put these docs then in this other index put these docs...".
Using logic in the output section will mean a separate REST call per conditional block and they are not parallelised.
---
### Author:  [@RITZ\_VERMA](https://discuss.elastic.co/u/RITZ_VERMA)
#### Post date: [August 8, 2019, 11:44pm UTC](https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815/6 "2019-08-08T23:44:39Z")
this make things a lot easier
thanks @guyboertje and apologies for late reply
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 5, 2019, 11:44pm UTC](https://discuss.elastic.co/t/can-we-send-logs-to-different-outputs-depending-on-filename-they-come-from/192815/7 "2019-09-05T23:44:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.