# Creating a custom index for filebeat

**URL:** https://discuss.elastic.co/t/creating-a-custom-index-for-filebeat/107509
**Category:** Beats
**Tags:** filebeat
**Created:** [November 14, 2017, 8:35am UTC](https://discuss.elastic.co/t/creating-a-custom-index-for-filebeat/107509 "2017-11-14T08:35:48Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Widget](https://avatars.discourse-cdn.com/v4/letter/w/838e76/32.png) [@Widget](https://discuss.elastic.co/u/Widget)
#### Post date: [November 14, 2017, 8:35am UTC](https://discuss.elastic.co/t/creating-a-custom-index-for-filebeat/107509/1 "2017-11-14T08:35:48Z")

</div>

Hi Team,

I would like to log from filebeat to one a custom index.  
I would like to set filebeat to log filebeat-division1-\* to logstash from one server and filebeat-division2-\* from another server.  
Then set access to those indexes for specific users.

Alternatively can you allow one user to only see logs with field division1 and another user only see division2 logs?

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [November 15, 2017, 2:01am UTC](https://discuss.elastic.co/t/creating-a-custom-index-for-filebeat/107509/2 "2017-11-15T02:01:25Z")

</div>

Assuming you send all this data through LS, you should be able to add some logic for example based on beat.hostname to which index the data goes. As soon as you have such an index pattern above, you can use X-Pack Security to define access rights based on index patterns.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 13, 2017, 2:01am UTC](https://discuss.elastic.co/t/creating-a-custom-index-for-filebeat/107509/3 "2017-12-13T02:01:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
