# Error/Info log separation

**URL:** <https://discuss.elastic.co/t/error-info-log-separation/46983>\
**Category:** Logstash\
**Created:** [April 11, 2016, 11:38am UTC](https://discuss.elastic.co/t/error-info-log-separation/46983 "2016-04-11T11:38:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [April 11, 2016, 11:38am UTC](https://discuss.elastic.co/t/error-info-log-separation/46983/1 "2016-04-11T11:38:18Z")

</div>

Hi,  
We have some log files where INFO/ERROR/WARN are recorded in single file.

1. What is the approach generally in ELK to handle such files?
2. What if we want error, info, warn logs separately under separate type mappings?
3. is this very heavy or expensive operation to filer out and send under diff type/index? how to do that?
4. OR we have to separately logs those at application's level using some logginf framework before we get it into central logging?

br,  
Sunil

---

<div class="post-metadata">

**Author:** ![bhatch](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@bhatch](https://discuss.elastic.co/u/bhatch)\
**Post date:** [April 11, 2016, 10:38pm UTC](https://discuss.elastic.co/t/error-info-log-separation/46983/2 "2016-04-11T22:38:58Z")

</div>

You could create a separate index, or you could put it into the same index and have put the error level into it's own field.  
If you want separate mappings you would probably be better off doing separate indexes.

Logstash has a way of dynamically creating separate [indexes](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index).

For example, let's say you put the logging level into a field called "LogLevel". In your Logstash output you could put something like the below. This will create a dynamic index with the loglevel included in the index name. For example, today's index would be "Logfiles-INFO-2016.04.11", "Logfiles-ERROR-2016.04.11", and so on.  
You would probably want to do some verification that LogLevel doesn't ever get weird values in it, otherwise you might end up with some strange index names.

```
output {
    elasticsearch {
        hosts => "ElasticClusterName"
        index => "Logfiles-%{LogLevel}-%{+YYYY.MM.dd}"
    }
}
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 12, 2016, 12:27am UTC](https://discuss.elastic.co/t/error-info-log-separation/46983/3 "2016-04-12T00:27:26Z")

</div>

FYI the Logstash forwarder is deprecated, you should move away from it ASAP.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/error-info-log-separation/46983/4 "2017-07-06T05:02:52Z")

</div>

Closed on July 6, 2017, 5:02am UTC