# Filebeat process different log paths and write data to seperate index,Without use of logstash and follow ILM/rollover alias defined in template

**URL:** <https://discuss.elastic.co/t/filebeat-process-different-log-paths-and-write-data-to-seperate-index-without-use-of-logstash-and-follow-ilm-rollover-alias-defined-in-template/332593>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 4, 2023, 6:57pm UTC](https://discuss.elastic.co/t/filebeat-process-different-log-paths-and-write-data-to-seperate-index-without-use-of-logstash-and-follow-ilm-rollover-alias-defined-in-template/332593 "2023-05-04T18:57:40Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 4, 2023, 8:26pm UTC](https://discuss.elastic.co/t/filebeat-process-different-log-paths-and-write-data-to-seperate-index-without-use-of-logstash-and-follow-ilm-rollover-alias-defined-in-template/332593/5 "2023-05-04T20:26:10Z")

</div>

You need to follow [these](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/set-up-lifecycle-policy.html) directions

You will need to set up everything in with the templates and create an [initial managed index for each](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/set-up-lifecycle-policy.html#create-initial-index)

Look at method #2 [here](https://discuss.elastic.co/t/filebeat-writing-to-its-own-index/310842/28) then generalized for your use cases with

` index: "%{[fields.index]}-%{[agent.version]}"`

You could also just set the index in each input see [here](https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-input-log.html#_index_9):

```auto
filebeat.inputs:
- type: log
  enabled: true
  index: "mis-monitoring-usecases-{[agent.version]}"
...

- type: log
  enabled: true
  paths:
  - /l/app/LOG_ROOT/Demo/*.log
  index: "mis-logs-{[agent.version]}"

```

This is in the wrong place

```auto
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

```

not sure why it is in the middle of your inputs ... if you use no modules you can take it out.  
In fact not sure how that is working that should break things

You really need to get off 7.9.1 ... whatever the reason you are staying on it, does not outweigh the benefits of being on a newer version.

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-process-different-log-paths-and-write-data-to-seperate-index-without-use-of-logstash-and-follow-ilm-rollover-alias-defined-in-template/332593)._