# Filebeat store under different index per host?
**URL:** https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270
**Category:** Beats
**Tags:** filebeat
**Created:** [May 10, 2017, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270 "2017-05-10T14:45:49Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@xon](https://discuss.elastic.co/u/xon)
#### Post date: [May 10, 2017, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270/1 "2017-05-10T14:45:49Z")
Hi,
I am having different instances of filebeat running sending different logs and i want to output to elasticsearch and index per host. Is this a nested if statement and which field should I cross reference? Is it possible for someone to provide me a short example?
Thanks
---
### Author:  [@giuseppe](https://discuss.elastic.co/u/giuseppe)
#### Post date: [May 10, 2017, 8:15pm UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270/2 "2017-05-10T20:15:49Z")
Would you be able to use `beat.hostname`?
[https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-beat.html#\_beat\_hostname](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-beat.html#_beat_hostname)
---
### Author:  [@xon](https://discuss.elastic.co/u/xon)
#### Post date: [May 11, 2017, 10:24am UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270/3 "2017-05-11T10:24:43Z")
Thanks for your help. Still this doesnt work
> output {
> elasticsearch {
> if beat.hostname == "testinghost1" {
> hosts =\> "192.168.0.1:9200"
> manage\_template =\> true
> index =\> "testing-%{+YYYY.MM.dd}"
> }
> }
> }
Error says:
ERROR logstash.agent - Cannot create pipeline {:reason=\>"Expected one of #, =\> at line 28, column 8 (byte 478) after output {\n elasticsearch {\n if "}
i went over this here ==\> [Question: Using the beat.hostname variable in Logstash config · Issue #869 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/869)
where it says
"I also had to switch from the field syntax beat.hostname to [beat][hostname] to get it to work with the file output properly" Stiill it doesnt work
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [May 11, 2017, 10:37am UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270/4 "2017-05-11T10:37:53Z")
please add some more details about your environment. It was so not clear you're trying to filter events in Logstash.
Your syntax for the field accessor is incorrect. I think in Logstash you have to use `[beat][hostname]`.
---
### Author:  [@xon](https://discuss.elastic.co/u/xon)
#### Post date: [May 11, 2017, 10:42am UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270/5 "2017-05-11T10:42:47Z")
I tried that and still it doesnt work. Line 28 is where the if statement is...
> output {
> elasticsearch {
> if [beat][hostname] == "testinghost" {
> hosts =\> "192.168.0.1:9200"
> manage\_template =\> true
> index =\> "testing-%{+YYYY.MM.dd}"
> document\_type =\> "apache"
> }
> }
> }
Basically there is filebeat running in two different web servers and I want to index their data separately. My filebeat part is looking alright since I can index everything together under a single index however I need to create two different.
Thanks
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [May 11, 2017, 10:07pm UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270/6 "2017-05-11T22:07:23Z")
what exactly do you mean by "doesn't work"? Any error message?
[This doc shows how to use conditionals in Logstash](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals).
Have you verified the events matching structure and content as you expect?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 8, 2017, 10:21pm UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270/7 "2017-06-08T22:21:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.