# Duplicating Event To Multiple Indices

**URL:** https://discuss.elastic.co/t/duplicating-event-to-multiple-indices/332955
**Category:** Logstash
**Created:** [May 9, 2023, 2:39pm UTC](https://discuss.elastic.co/t/duplicating-event-to-multiple-indices/332955 "2023-05-09T14:39:43Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [May 9, 2023, 2:39pm UTC](https://discuss.elastic.co/t/duplicating-event-to-multiple-indices/332955/1 "2023-05-09T14:39:43Z")

</div>

I have events coming in with an ID of 123. Is it possible to have this event indexed into two different indices by doing something like below?

```auto
output {
  if [log] == 123 {
    elasticsearch {
      index => "123logs"
    }
  }
  elasticsearch {
    index => "all_logs"
  }
}

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 9, 2023, 3:19pm UTC](https://discuss.elastic.co/t/duplicating-event-to-multiple-indices/332955/2 "2023-05-09T15:19:59Z")

</div>

> [@wwalker](#):
>
> Is it possible to have this event indexed into two different indices by doing something like below?

Yes, you can use conditionals to route some messages to multiple outputs.

---

<div class="post-metadata">

### Author: ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [May 10, 2023, 4:02pm UTC](https://discuss.elastic.co/t/duplicating-event-to-multiple-indices/332955/3 "2023-05-10T16:02:50Z")

</div>

So, just to be clear, an event continues to process all outputs until there are none left, it does not stop processing outputs on first match?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 10, 2023, 4:18pm UTC](https://discuss.elastic.co/t/duplicating-event-to-multiple-indices/332955/4 "2023-05-10T16:18:40Z")

</div>

That is correct.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 7, 2023, 4:19pm UTC](https://discuss.elastic.co/t/duplicating-event-to-multiple-indices/332955/5 "2023-06-07T16:19:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.