# Create several Index from same filebeats source

**URL:** <https://discuss.elastic.co/t/create-several-index-from-same-filebeats-source/186115>\
**Category:** Logstash\
**Created:** [June 17, 2019, 4:40pm UTC](https://discuss.elastic.co/t/create-several-index-from-same-filebeats-source/186115 "2019-06-17T16:40:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![robymemo](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@robymemo](https://discuss.elastic.co/u/robymemo)\
**Post date:** [June 17, 2019, 4:40pm UTC](https://discuss.elastic.co/t/create-several-index-from-same-filebeats-source/186115/1 "2019-06-17T16:40:02Z")

</div>

Hi to all,

i'm newbi on this tecnology.  
I'm trying to generate 2 different index basing on the same input files from beats.

My basic configuration (1) (working) create the index 'log\_reporti\_YYYYMM' taking all the '.log' files from the path '/var/log/' (dir configured as input in the filebeats conf file) .

Now I would to take some files from a subfolder (es. '/var/log/test\_path\_log/) that should fill a new index .  
I tryed to modify the configuration (2) but not work properly. Anyone can help me ?

thanks in advance

(1)  
input {  
beats {  
port =\> 5044  
type =\> "beats"  
}  
}

output {

if [type] == "beats"  
{  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)" ]  
index =\> "log\_reporti-%{+YYYY.MM}"  
}  
}  
}

(2)  
input {  
beats {  
port =\> 5044  
type =\> "beats"  
}  
file {  
path =\> "/var/log/temp\_tst/_._"  
type =\> "fbeats2"  
}

file {  
path =\> "/var/log/\*.log"  
type =\> "fbeats"  
}

}

output {

if [type] == "fbeats"  
{  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)" ]  
index =\> "log\_reporti-%{+YYYY.MM}"  
}  
}

if [type] == "fbeats2"  
{  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)" ]  
index =\> "log\_repo\_testo-%{+YYYY.MM}"  
}  
}  
}Preformatted text

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 17, 2019, 4:53pm UTC](https://discuss.elastic.co/t/create-several-index-from-same-filebeats-source/186115/2 "2019-06-17T16:53:21Z")

</div>

You really need to use markdown to preserve characters such as \* and \_ in your posts. Edit you post, select the configuration and click on \</\> in the toolbar above the edit pane. Then check that your post looks correct in the preview pane to the right.

---

<div class="post-metadata">

**Author:** ![robymemo](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@robymemo](https://discuss.elastic.co/u/robymemo)\
**Post date:** [June 19, 2019, 12:50pm UTC](https://discuss.elastic.co/t/create-several-index-from-same-filebeats-source/186115/3 "2019-06-19T12:50:11Z")

</div>

any help ??

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2019, 12:50pm UTC](https://discuss.elastic.co/t/create-several-index-from-same-filebeats-source/186115/4 "2019-07-17T12:50:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.