# Contains condition on multiple index - Filebeat

**URL:** <https://discuss.elastic.co/t/contains-condition-on-multiple-index-filebeat/266128>\
**Category:** Beats\
**Created:** [March 3, 2021, 2:41pm UTC](https://discuss.elastic.co/t/contains-condition-on-multiple-index-filebeat/266128 "2021-03-03T14:41:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [March 3, 2021, 2:41pm UTC](https://discuss.elastic.co/t/contains-condition-on-multiple-index-filebeat/266128/1 "2021-03-03T14:41:33Z")

</div>

Hello,  
I'm using filebeat to collect information from log but I need to slip them on different Indexes. To do this I'm using

```
indices:
    - index: "filebeat-%{[agent.version]}-api-%{+yyyy.MM.dd}"
      when.contains:
        message: "webapi"

```

I need to know if it is possible to check the condition when message contains host="[myhost.site.com](http://myhost.site.com)" (including quots)

I'm trying but it does not works may some help please  
thanks for your time  
best regards

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 5, 2021, 10:29am UTC](https://discuss.elastic.co/t/contains-condition-on-multiple-index-filebeat/266128/2 "2021-03-05T10:29:40Z")

</div>

I'm not convinced if there is such condition. It would be nice if you can figure out a different way of determining traffic from that host. Maybe different log files?

---

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [March 8, 2021, 12:59pm UTC](https://discuss.elastic.co/t/contains-condition-on-multiple-index-filebeat/266128/3 "2021-03-08T12:59:28Z")

</div>

Yes there are different log file, but I did not find a way to filter on filename

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2021, 12:59pm UTC](https://discuss.elastic.co/t/contains-condition-on-multiple-index-filebeat/266128/4 "2021-04-05T12:59:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.