# How can i create different indices for different module

**URL:** <https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 2, 2021, 9:46am UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095 "2021-04-02T09:46:02Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shriram\_Wasule](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shriram_wasule/32/75468_2.png) [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\
**Post date:** [April 2, 2021, 9:46am UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/1 "2021-04-02T09:46:02Z")

</div>

Hello,  
i have two modules activated Apache and tomcat,, i want to store logs of this two in two different indices for better result but i am not able to get how to do that.  
please help me to set this configuration in my filebeat.  
i am using Elasticsearch, Filebeat & kibana

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 2, 2021, 12:54pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/2 "2021-04-02T12:54:31Z")

</div>

See [Filebeat Apache Module Change Index Name - #2 by jsoriano](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/2)

---

<div class="post-metadata">

**Author:** ![Shriram\_Wasule](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shriram_wasule/32/75468_2.png) [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\
**Post date:** [April 3, 2021, 9:25am UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/3 "2021-04-03T09:25:14Z")

</div>

Hi,  
Thanks for the reply.  
I have another query,.  
Now the scenerio is i want to create visualization to check which error occurs how much time in given timeframe,  
my apache error is showing in "message" field but when i am creating visualization for it i am unable to get that that field to include, can you please tell me why is this happening and any suggestions are also welcome.

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 3, 2021, 1:22pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/4 "2021-04-03T13:22:53Z")

</div>

What kind of visualization? Message is a text field so your ability to put it in a visualization maybe limited.

---

<div class="post-metadata">

**Author:** ![Shriram\_Wasule](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shriram_wasule/32/75468_2.png) [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\
**Post date:** [April 3, 2021, 1:35pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/5 "2021-04-03T13:35:04Z")

</div>

I want to see top 5 errors in given duration and count for that each top 5 errors

Shriram Wasule  
Computer Engineer

9764324411 |  
[shriramwasule@gmail.com](mailto:shriramwasule@gmail.com)

[https://wwwshriramwasulecom.000webhostapp.com/](https://wwwshriramwasulecom.000webhostapp.com/)

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 3, 2021, 1:41pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/6 "2021-04-03T13:41:51Z")

</div>

Unless the field is mapped as both text and keyword I don't think u can do sorting and aggregation of the message field

---

<div class="post-metadata">

**Author:** ![Shriram\_Wasule](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shriram_wasule/32/75468_2.png) [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\
**Post date:** [April 3, 2021, 1:53pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/7 "2021-04-03T13:53:30Z")

</div>

Okay..so how can I achieve that?

Shriram Wasule  
Computer Engineer

9764324411 |  
[shriramwasule@gmail.com](mailto:shriramwasule@gmail.com)

[https://wwwshriramwasulecom.000webhostapp.com/](https://wwwshriramwasulecom.000webhostapp.com/)

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 3, 2021, 2:29pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/8 "2021-04-03T14:29:17Z")

</div>

so first check the mapping for the indices that you're interested in, [Get mapping API | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html). Then if the message field is not mapped as both update the index/index template to use a multi field mapping for that field, [fields | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html).

---

<div class="post-metadata">

**Author:** ![Shriram\_Wasule](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shriram_wasule/32/75468_2.png) [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\
**Post date:** [April 7, 2021, 11:27am UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/9 "2021-04-07T11:27:52Z")

</div>

Thank you fro reply,  
i did tries to follow mentioned steps

i am getting this error after running following

```auto
PUT filebeat-7.12.0-2021.03.30-000001
{
  "mappings": {
    "properties": {
      "message": {
        "type": "text",
        "fields": {
          "keyword": { 
            "type": "keyword"
          }
        }
      }
    }
  }
}

```

Error:

```auto
{
  "error" : {
    "root_cause" : [
      {
        "type" : "resource_already_exists_exception",
        "reason" : "index [filebeat-7.12.0-2021.03.30-000001/] already exists",
        "index_uuid" : "",
        "index" : "filebeat-7.12.0-2021.03.30-000001"
      }
    ],
    "type" : "resource_already_exists_exception",
    "reason" : "index [filebeat-7.12.0-2021.03.30-000001/] already exists",
    "index_uuid" : "",
    "index" : "filebeat-7.12.0-2021.03.30-000001"
  },
  "status" : 400
}

```

my use case is like i want to create a data table for apache errors,  
like which error is comes how many times, inshort count of each error occured, but not able to see message filed during creation.

But i am still can't see that message field with message.keword in visualization

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 7, 2021, 12:07pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/10 "2021-04-07T12:07:26Z")

</div>

you can't do it for an index that already exists. You either need to update the template or create a new index. I would create a new index and add some data just to test that it works and does what you want.

---

<div class="post-metadata">

**Author:** ![Shriram\_Wasule](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shriram_wasule/32/75468_2.png) [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\
**Post date:** [April 7, 2021, 12:09pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/11 "2021-04-07T12:09:21Z")

</div>

okay, thanks,  
so how can i update my template with this changes in field?

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 7, 2021, 4:45pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/12 "2021-04-07T16:45:03Z")

</div>

[Update mapping API | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html) and [Create or update index template API | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates-v1.html). You can also update the index template mapping from in Kibana in the Index Template admin page.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2021, 6:45pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095/13 "2021-05-05T18:45:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.