# Разделение логов по индексам в Filebeat
**URL:** https://discuss.elastic.co/t/filebeat/239125
**Category:** Вопросы на русском языке
**Created:** [June 29, 2020, 2:19pm UTC](https://discuss.elastic.co/t/filebeat/239125 "2020-06-29T14:19:44Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Ivan\_Bykov](https://discuss.elastic.co/u/Ivan_Bykov)
#### Post date: [June 29, 2020, 2:19pm UTC](https://discuss.elastic.co/t/filebeat/239125/1 "2020-06-29T14:19:44Z")
Есть два типа логов
/var/log/1.log и 2.log
Подскажите пожалуйста, как настроить правильно filebeat чтобы каждому и этих логов соответствовал свой индекс для logstash + elastic?
В конфиге у меня сейчас вот так:
```auto
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /opt/xxxx/logs/xxx.log
#- c:\programdata\elasticsearch\logs\*
output.logstash:
# The Logstash hosts
hosts: ["192.168.0.xxx:5044"]
protocol: "https"
index: "index-%{[beat.version]}-%{+yyyy.MM.dd}"
setup.template.name: "index"
setup.template.pattern: "*-index-%{[beat.version]}-*"
setup.template.enabled: true
compression_level: 9
```
Т.е. если я просто добавлю еще один paths:
- /opt/xxxx/logs/xxx2.log
то он будет соответствовать index, а хотелось бы чтобы у него был свой index2 для logstash.
Подскажите как сделать или где почитать пожалуйста.
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [June 29, 2020, 2:41pm UTC](https://discuss.elastic.co/t/filebeat/239125/2 "2020-06-29T14:41:07Z")
> [@Output to multiple indexes straight from filebeat.yml?](https://discuss.elastic.co/t/output-to-multiple-indexes-straight-from-filebeat-yml/130165/2):
>
> you hardcoded the index name in your output to index1. It is the index setting which selects the index name to use. See [index docs](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es) and [indices docs](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#_literal_indices_literal). The index setting supports [Format Strings](https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format-type.html#_format_string_sprintf). That is, you can use any field in the event to construct the index. e.g. filebeat.prospectors: - ... fields: type: "logs1" - ... fields: type: "logs2" setup.template.name: "index-%{[beat.version]}" setup.template.pattern: "index-%{[beat.version]}-\*" output.elasticsearch: ... index: "…
Только этот пост старый, теперь `prospectors` завутся `inputs`. Остальное должно работать.
---
### Author:  [@Ivan\_Bykov](https://discuss.elastic.co/u/Ivan_Bykov)
#### Post date: [June 29, 2020, 3:01pm UTC](https://discuss.elastic.co/t/filebeat/239125/3 "2020-06-29T15:01:58Z")
Т.е. получается
```auto
paths:
- /opt/xxxx/logs/test1.log
- /opt/xxxx/logs/test2.log
output.logstash:
# The Logstash hosts
hosts: ["192.168.0.xxx:5044"]
protocol: "https"
fields: type: "test1"
fields: type: "test2"
filebeat.inputs: '%{[test1]}-%{+yyyy.MM.dd}'
filebeat.inputs: '%{[test2]}-%{+yyyy.MM.dd}'
index: "index-%{[beat.version]}-%{+yyyy.MM.dd}"
setup.template.name: "index"
setup.template.pattern: "*-index-%{[beat.version]}-*"
setup.template.enabled: true
compression_level: 9
```
Так?
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [June 29, 2020, 3:49pm UTC](https://discuss.elastic.co/t/filebeat/239125/4 "2020-06-29T15:49:53Z")
> [@Ivan\_Bykov](#):
>
> Так?
Не так. Вам надо создать два объекта `input`, как во втором примере на [этой](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html) странице. Каждый input будет иметь свое поле, и это поле пойдет как часть `%{[fields.type]:other}` в поле `index` в output.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 27, 2020, 3:49pm UTC](https://discuss.elastic.co/t/filebeat/239125/5 "2020-07-27T15:49:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.