# Creat multiple index pattern
**URL:** https://discuss.elastic.co/t/creat-multiple-index-pattern/137279
**Category:** Logstash
**Created:** [June 25, 2018, 2:43pm UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279 "2018-06-25T14:43:34Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@kimfut](https://discuss.elastic.co/u/kimfut)
#### Post date: [June 25, 2018, 2:43pm UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/1 "2018-06-25T14:43:34Z")
hello every one ,
i am trying to make an config to creat a multiple index pattern with logstash , i am using filebeat also ,
principally i have two types of file , each type locate in separate folder
so there is my filebeat.yml :
> output:
> logstash:
> enabled: true
> hosts:
> - 213.X.X.X:5002
> timeout: 15
>
> filebeat:
> prospectors:
> -
> paths:
> - "/home/hakim/cluster2/\*.log"
> input\_type: log
> document\_type: cluster2
>
> ```
> -
> paths:
> - "/home/hakim/clustermon/*.log"
> input_type: log
> document_type: clustermon
>
> ```
and there is my logstash.conf :
> input {
> beats {
> port =\> 5002
> }
> }
>
> ## Add your filters / logstash plugins configuration here
>
> filter {
> grok {
>
> match =\> { "message" =\> [my filter **(i deleted it because so long )**] }
> }
> date {
> match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
> locale =\> en
> }
> geoip {
> source =\> "clientip"
> }
>
> }
>
> output {
> if "\_grokparsefailure" in [tags] {
> # write events that didn't match to a file
> file { "path" =\> "home/hakim/grok\_failures.txt" }
> }
> else{
> if [type] == 'cluster2' {
> elasticsearch {
> hosts =\> ["213.X.X.X:9200"]
> #manage\_template =\> false
> index =\> "cluster2"
> user =\> XXXX
> password =\> XXXX
> }
> }
> else if [type] == 'clustermon' {
> elasticsearch {
> hosts =\> ["213.X.X.X:9200"]
> #manage\_template =\> false
> index =\> "clustermon"
> user =\> XXXX
> password =\> XXXX
> }
> }
> }
> }
when i put docker-compose up , all it's okay but when i added file logs there nothing happen , i didn't know why ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 25, 2018, 2:48pm UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/2 "2018-06-25T14:48:21Z")
Debug this systematically. Is Logstash getting any logs at all? Have you looked in the Logstash logs for clues about any connectivity problems with Elasticsearch?
---
### Author:  [@kimfut](https://discuss.elastic.co/u/kimfut)
#### Post date: [July 5, 2018, 2:35pm UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/3 "2018-07-05T14:35:18Z")
> [@magnusbaeck](#):
>
> Have you looked in the Logstash logs for clues about any connectivity problems with Elasticsearch?
hi thank you for your response ,
i looked in logs , there are no problems
i think the condition which a make ' if [type] == "type" ' it's not taken by the code so nothing happen
i need help please if you are any other suggestion to how separate creation of indexes pattern by their path location.
thank you
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 5, 2018, 4:28pm UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/4 "2018-07-05T16:28:21Z")
Use a `stdout { codec => rubydebug }` output (not wrapped in a conditional) to dump the raw contents of the events to the Logstash log. That'll make it very clear if the `type` field indeed contains one of the two strings you support.
---
### Author:  [@kimfut](https://discuss.elastic.co/u/kimfut)
#### Post date: [July 6, 2018, 9:14am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/5 "2018-07-06T09:14:48Z")
> [@magnusbaeck](#):
>
> `type` field indeed contains one of the two strings you support.
i used it , there a no 'type' field in my logstash logs , i noticed that there are 'source' field , can i use it instead ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 6, 2018, 9:19am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/6 "2018-07-06T09:19:59Z")
You can use whatever field you want. What fields you use to categorize your logs is up to you, but be careful about using filenames as they're more likely to change.
---
### Author:  [@kimfut](https://discuss.elastic.co/u/kimfut)
#### Post date: [July 6, 2018, 9:59am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/7 "2018-07-06T09:59:54Z")
i tried with source it's worked , but i have to make the exact source ,now what i need is for example :
source = "/doc/file1.log" , but in /doc folder we have other logs files , i tried to use : if source == "/doc/\*" for all logs files it's doen't work and i have to specify file per file , is there a way to specify all log files contained in folder ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 6, 2018, 11:32am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/8 "2018-07-06T11:32:00Z")
As I said, using filenames isn't a great idea. Instead, configure the inputs (Logstash's file input, Filebeat, or whatever you've got) to add a field (e.g. `type` but could be anything) that indicate the kind of log. Then your filters can focus on that field instead.
---
### Author:  [@kimfut](https://discuss.elastic.co/u/kimfut)
#### Post date: [July 9, 2018, 8:42am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/9 "2018-07-09T08:42:00Z")
hi , i added 'type' tags , now it's appear in logstash logs , but when i use like with "source" , i mean
{ if [type] == "type"} , it doesn't work for me ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 9, 2018, 11:30am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/10 "2018-07-09T11:30:47Z")
To get help you need to show your Logstash configuration and an example message (use a `stdout { codec => rubydebug }` output to dump a raw event).
---
### Author:  [@kimfut](https://discuss.elastic.co/u/kimfut)
#### Post date: [July 9, 2018, 12:47pm UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/11 "2018-07-09T12:47:16Z")
it show me in each log :
prospector =\> { "type" =\> "nameType" }
so i guess the conditional in logstash.yml must change in something like ' if [prospector] == "type" =\> "nameTYPE" '
?
note : in kibana it's the field created displayed : prospector.type
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 9, 2018, 4:32pm UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/12 "2018-07-09T16:32:54Z")
This is what you need:
```
if [prospector][type] == "nameType" {
```
---
### Author:  [@kimfut](https://discuss.elastic.co/u/kimfut)
#### Post date: [July 10, 2018, 8:27am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/13 "2018-07-10T08:27:49Z")
it's works , thank you a lot !!! 🙂
---
### Author:  [@kimfut](https://discuss.elastic.co/u/kimfut)
#### Post date: [July 13, 2018, 11:02am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/14 "2018-07-13T11:02:30Z")
hi , i have just a question , can i do my code now with 'translate' instead of 'if , else if ...' because i have more than 2 indexes to creat ? also as i know there is no "switch case" on logstash config
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 13, 2018, 11:32am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/15 "2018-07-13T11:32:19Z")
Sure, you can use a translate filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 10, 2018, 11:32am UTC](https://discuss.elastic.co/t/creat-multiple-index-pattern/137279/16 "2018-08-10T11:32:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.