# Filebeat push same event in multiple indices

**URL:** <https://discuss.elastic.co/t/filebeat-push-same-event-in-multiple-indices/270828>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 21, 2021, 10:33am UTC](https://discuss.elastic.co/t/filebeat-push-same-event-in-multiple-indices/270828 "2021-04-21T10:33:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![screwyy](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@screwyy](https://discuss.elastic.co/u/screwyy)\
**Post date:** [April 21, 2021, 10:33am UTC](https://discuss.elastic.co/t/filebeat-push-same-event-in-multiple-indices/270828/1 "2021-04-21T10:33:24Z")

</div>

Hello, is it possible to send the same event into multiple indices in the same elasticsearch cluster?  
Example filebeat.yml:

```auto
	filebeat.config.inputs:
	  enabled: true
	  path: ${path.config}/inputs/*.yml
	  reload:
		enabled: true
		period: 10s
	processors:
	  - decode_json_fields:
		  fields: ["metadata.country"]
	output:
	  elasticsearch:
		hosts: ["https://xxx:9200"]
		indices:
		  - index: "filebeat-7.12.0-app1"
			when.equals:
			  component: "app1"
		  - index: "filebeat-usa"
			when.equals:
			  metadata.country: "usa"

```

and this is the filebeat input:

```auto
	- type: log
	  paths:
		- /var/log/apps/aaa.json
	  fields:
		component: app1
		team: xxx
	  fields_under_root: true
	  scan_frequency: 10s
	  json.keys_under_root: true
	  json.add_error_key: true

```

test command:

```auto
    echo '{"outer":"value","metadata.country":"usa","inner":"{\"data\":\"value\"}"}' >> /var/log/apps/aaa.json

```

Expected result is to have the same event in both indices: `filebeat-7.12.0-app1` (first match - because of component field) and `filebeat-usa` (second match - because of processors and the decode of the specific field metadata.country).

Actual result is: the event goes into the first match (which is correct based on the docs), but is it possible to send the same event into multiple indices without logstash?

I know it's possible with logstash but I don't want to introduce another component into the infrastructure.

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 22, 2021, 1:06am UTC](https://discuss.elastic.co/t/filebeat-push-same-event-in-multiple-indices/270828/2 "2021-04-22T01:06:55Z")

</div>

I don't think it is when sending directly from filebeat. I think ur best way is to send from logstash as that can multiple outputs in parallel.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2021, 3:07am UTC](https://discuss.elastic.co/t/filebeat-push-same-event-in-multiple-indices/270828/3 "2021-05-20T03:07:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.