# How can i create 2 indexs for to 2 filebeat inputs?

**URL:** <https://discuss.elastic.co/t/how-can-i-create-2-indexs-for-to-2-filebeat-inputs/142178>\
**Category:** Logstash\
**Created:** [July 30, 2018, 12:40pm UTC](https://discuss.elastic.co/t/how-can-i-create-2-indexs-for-to-2-filebeat-inputs/142178 "2018-07-30T12:40:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![med\_amine](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@med\_amine](https://discuss.elastic.co/u/med_amine)\
**Post date:** [July 30, 2018, 12:40pm UTC](https://discuss.elastic.co/t/how-can-i-create-2-indexs-for-to-2-filebeat-inputs/142178/1 "2018-07-30T12:40:13Z")

</div>

dhnjgdjghghjgh

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [July 30, 2018, 1:37pm UTC](https://discuss.elastic.co/t/how-can-i-create-2-indexs-for-to-2-filebeat-inputs/142178/2 "2018-07-30T13:37:47Z")

</div>

Hi med,

Your config would be much easier to read if you would use _Preformatted text_ ( the `</>` symbol in the toolbar)...

I do what you are looking to do like this.

```
cat /etc/filebeat/conf.d/syslogs.yml
...
- type: log
  paths:
    - /var/log/auth.log
    - /var/log/faillog
    - /var/log/messages
    - /var/log/syslog
  encoding: plain
  fields:
    log_prefix: dc
    log_idx: syslog-beat
  fields_under_root: false
...

```

So I add a few extra fields per _type_ of log

In my Logstash \_filter section I have

```
filter {
...
    #############
    # Adding @metadata needed for index sharding to Filebeat logs
    mutate {
      copy => {
       "[fields][log_prefix]" => "[@metadata][log_prefix]"
       "[fields][log_idx]" => "[@metadata][index]"
      }
    }
  }
  #############
...

```

The above is because on some Logstash inputs I already set `[@metadata][log_prefix]` and `[@metadata][index]`

Finally on my Logstash output I use

```
output {

  elasticsearch {
...
        index => "%{[@metadata][log_prefix]}-%{[@metadata][index]}-%{+YYYY.MM.dd}"
  }
}

```

Adjust to taste 😃

Hope that helps.

-AB

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2018, 1:45pm UTC](https://discuss.elastic.co/t/how-can-i-create-2-indexs-for-to-2-filebeat-inputs/142178/3 "2018-08-27T13:45:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.