# Handling multiples modules output to multiples indexes, good practice?

**URL:** <https://discuss.elastic.co/t/handling-multiples-modules-output-to-multiples-indexes-good-practice/184085>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 4, 2019, 3:37am UTC](https://discuss.elastic.co/t/handling-multiples-modules-output-to-multiples-indexes-good-practice/184085 "2019-06-04T03:37:38Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\
**Post date:** [June 4, 2019, 8:18am UTC](https://discuss.elastic.co/t/handling-multiples-modules-output-to-multiples-indexes-good-practice/184085/2 "2019-06-04T08:18:26Z")

</div>

Hello Tanguy .  
Im not sure to completely understand your problem  
There are differents ways to do what you want .

If you want to have different index names and , it's simple

> ```
> output.elasticsearch:
> ...
> index: "%{[fields.type]}-putwhatyouwanthere"
> 
> ```

> Also is the the good way to do this ? I feel like letting everything under a filebeat-%{+yyyy.MM.dd} is a bad idea (I end up with 1300+ fields on the index), but I didn't find a "best practices" section about filebeat --\> multiples indexes too..

Letting everything under filebeat-%{+yyyy.MM.dd} is clearly a bad idea if you have thousands of different fields  
But if you do `filebeat-%{[fields.type]}`  
you will have many different filebeat index as you have differents fields.type, and you will avoid the heavy monolithic trash index

````
However, how can I add custom filed like show above :

```
  fields:
    type: "system"
```

to a module ? (as I use module instead of processor) I couldn't find the answer on the web.

````

I don't know , you should test you can try to add  
`- module: thenameofthemodule`  
and then

> ```
> - ...
> fields:
> type: "audit
> 
> ```

And lets see if it works .

---

_[View the full topic](https://discuss.elastic.co/t/handling-multiples-modules-output-to-multiples-indexes-good-practice/184085)._