# Hey, filebeat.inputs reads two log files. I am sending it to elasticsearch How can I show them in two different index names in kibana?

**URL:** https://discuss.elastic.co/t/hey-filebeat-inputs-reads-two-log-files-i-am-sending-it-to-elasticsearch-how-can-i-show-them-in-two-different-index-names-in-kibana/187841
**Category:** Beats
**Tags:** filebeat
**Created:** [June 27, 2019, 1:29pm UTC](https://discuss.elastic.co/t/hey-filebeat-inputs-reads-two-log-files-i-am-sending-it-to-elasticsearch-how-can-i-show-them-in-two-different-index-names-in-kibana/187841 "2019-06-27T13:29:34Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Jitendra\_Kumhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jitendra_kumhar/32/48640_2.png) [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)
#### Post date: [June 27, 2019, 1:29pm UTC](https://discuss.elastic.co/t/hey-filebeat-inputs-reads-two-log-files-i-am-sending-it-to-elasticsearch-how-can-i-show-them-in-two-different-index-names-in-kibana/187841/1 "2019-06-27T13:29:34Z")

</div>

Hello ,  
My filebeat.inputs reads two log files.  
I am sending it to elasticsearch  
How can I show them in two different index names in kibana?

---

<div class="post-metadata">

### Author: ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)
#### Post date: [June 27, 2019, 8:35pm UTC](https://discuss.elastic.co/t/hey-filebeat-inputs-reads-two-log-files-i-am-sending-it-to-elasticsearch-how-can-i-show-them-in-two-different-index-names-in-kibana/187841/2 "2019-06-27T20:35:38Z")

</div>

You can send to different indices based on any of the fields present in the document, so you could do something like the below:

```auto
output.elasticsearch:
  index: "default-%{+yyyy.MM.dd}"
  indices:
    - index: "application-one-%{+yyyy.MM.dd}"
      when.equals:
        application: "one"
    - index: "application-two-%{+yyyy.MM.dd}"
      when.equals:
        application: "two"

```

Would this work for you?

You can also cut out the middle man on the above and do something like:

```auto
output.elasticsearch:
  index: "%{[my-application-field]}-%{+yyyy.MM.dd}" 

```

---

<div class="post-metadata">

### Author: ![Jitendra\_Kumhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jitendra_kumhar/32/48640_2.png) [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)
#### Post date: [June 28, 2019, 7:45am UTC](https://discuss.elastic.co/t/hey-filebeat-inputs-reads-two-log-files-i-am-sending-it-to-elasticsearch-how-can-i-show-them-in-two-different-index-names-in-kibana/187841/3 "2019-06-28T07:45:15Z")

</div>

my-application-field is in input section?

```
filebeats.input:
-type: log
 fields:
   my-application-field: "one"

```

like this?

---

<div class="post-metadata">

### Author: ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)
#### Post date: [June 28, 2019, 8:57am UTC](https://discuss.elastic.co/t/hey-filebeat-inputs-reads-two-log-files-i-am-sending-it-to-elasticsearch-how-can-i-show-them-in-two-different-index-names-in-kibana/187841/4 "2019-06-28T08:57:06Z")

</div>

If there isn't already a field in the log messages that you can use differentiate between the two logs then you can do that, yeah

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 26, 2019, 8:57am UTC](https://discuss.elastic.co/t/hey-filebeat-inputs-reads-two-log-files-i-am-sending-it-to-elasticsearch-how-can-i-show-them-in-two-different-index-names-in-kibana/187841/5 "2019-07-26T08:57:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
