# Cross contamination of events in multiple indexes

**URL:** https://discuss.elastic.co/t/cross-contamination-of-events-in-multiple-indexes/85754
**Category:** Elasticsearch
**Created:** [May 15, 2017, 11:35am UTC](https://discuss.elastic.co/t/cross-contamination-of-events-in-multiple-indexes/85754 "2017-05-15T11:35:49Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![141984](https://avatars.discourse-cdn.com/v4/letter/1/c37758/32.png) [@141984](https://discuss.elastic.co/u/141984)
#### Post date: [May 15, 2017, 11:35am UTC](https://discuss.elastic.co/t/cross-contamination-of-events-in-multiple-indexes/85754/1 "2017-05-15T11:35:50Z")

</div>

I currently have an ELK setup with my web server log events flowing into an index by the name "web-server-logs". When I start pushing metric beat events to this ELK setup, my web server log events and metric beat events end up flowing into each others the indexes.

How can I push both the events to their respective indexes only?

I am pushing the events using filebeat and metricbeat into logstash

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 15, 2017, 12:05pm UTC](https://discuss.elastic.co/t/cross-contamination-of-events-in-multiple-indexes/85754/2 "2017-05-15T12:05:34Z")

</div>

It sounds like you may have multiple configuration files for Logstash that lack conditionals. All configuration files made available to Logstash will be concatenated, and if you do not use conditionals all data will go to all outputs.

---

<div class="post-metadata">

### Author: ![141984](https://avatars.discourse-cdn.com/v4/letter/1/c37758/32.png) [@141984](https://discuss.elastic.co/u/141984)
#### Post date: [May 17, 2017, 10:32am UTC](https://discuss.elastic.co/t/cross-contamination-of-events-in-multiple-indexes/85754/3 "2017-05-17T10:32:34Z")

</div>

Hi @Christian_Dahlqvist,

can I use a if condition in the configuration for the output and specific the index in the output configuration?

If not, then where do I specify the conditional routing?

--gibu

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 17, 2017, 10:38am UTC](https://discuss.elastic.co/t/cross-contamination-of-events-in-multiple-indexes/85754/4 "2017-05-17T10:38:24Z")

</div>

There are examples [in the documentation](https://www.elastic.co/guide/en/logstash/5.4/config-examples.html#using-conditionals) that show your how they are used.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2017, 10:38am UTC](https://discuss.elastic.co/t/cross-contamination-of-events-in-multiple-indexes/85754/5 "2017-06-14T10:38:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
