# Enable 2 different filebeat modules & send to different index name

**URL:** <https://discuss.elastic.co/t/enable-2-different-filebeat-modules-send-to-different-index-name/187733>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 27, 2019, 6:24am UTC](https://discuss.elastic.co/t/enable-2-different-filebeat-modules-send-to-different-index-name/187733 "2019-06-27T06:24:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [June 27, 2019, 6:24am UTC](https://discuss.elastic.co/t/enable-2-different-filebeat-modules-send-to-different-index-name/187733/1 "2019-06-27T06:24:17Z")

</div>

Hello,

I am trying to use a single filebeat, enabled with system & apache module to send to elasticsearch. I would want to have a system index and a apache index. How can i do this?  
ILM is enabled for me and for a single module, i set my index via this setting:

```
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "filebeat-linuxclient"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.overwrite: false

```

now i would like to have `filebeat-linuxclient-system` and `filebeat-linuxclient-apache` as the alias.

This is my current filebeat.yml file settings for enabling system module:

```
filebeat.inputs:

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:
  host: "kibana:5601"

output.elasticsearch:
  hosts: ["esnode1:9200", "esnode2:9200", "esnode3:9200"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

logging.metrics.period: 60

setup.ilm.enabled: auto
setup.ilm.rollover_alias: "filebeat-linuxclient"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.overwrite: false

```

How can i do this?

---

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [June 27, 2019, 8:48pm UTC](https://discuss.elastic.co/t/enable-2-different-filebeat-modules-send-to-different-index-name/187733/2 "2019-06-27T20:48:26Z")

</div>

Hi,

Does my comment [in this thread](https://discuss.elastic.co/t/hey-filebeat-inputs-reads-two-log-files-i-am-sending-it-to-elasticsearch-how-can-i-show-them-in-two-different-index-names-in-kibana/187841/2) help with what you're trying to achieve?

---

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [June 28, 2019, 10:41am UTC](https://discuss.elastic.co/t/enable-2-different-filebeat-modules-send-to-different-index-name/187733/3 "2019-06-28T10:41:38Z")

</div>

Should I comment out the ILM settings?

I guess I should write these settings in filebeat.yml and

```
output.elasticsearch:
  index: "default-%{+yyyy.MM.dd}"
  indices:
    - index: "filebeat-system-%{+yyyy.MM.dd}"
      when.equals:
        application: "system"
    - index: "filebeat-apache-%{+yyyy.MM.dd}"
      when.equals:
        application: "apache"

```

Do I need to tag `application: system` and `application: apache` in their modules config file?

---

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [June 28, 2019, 10:44am UTC](https://discuss.elastic.co/t/enable-2-different-filebeat-modules-send-to-different-index-name/187733/4 "2019-06-28T10:44:47Z")

</div>

I'm not familiar with ILM so I can't say what you'd want to do with that.

`application` was just an example of a potential field name you could use to differentiate between the two log sources.

I think given you're using two different modules you can probably use the `event.module` field or something similar to configure different index outputs.

---

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [June 28, 2019, 11:04am UTC](https://discuss.elastic.co/t/enable-2-different-filebeat-modules-send-to-different-index-name/187733/5 "2019-06-28T11:04:49Z")

</div>

Alright i will give it a try! Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 26, 2019, 11:04am UTC](https://discuss.elastic.co/t/enable-2-different-filebeat-modules-send-to-different-index-name/187733/6 "2019-07-26T11:04:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.