# How can I parse 2 log files to 2 index in Kibana **URL:** \ **Category:** Logstash\ **Created:** [August 17, 2021, 3:13pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711 "2021-08-17T15:13:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![MT2021](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@MT2021](https://discuss.elastic.co/u/MT2021)\ **Post date:** [August 17, 2021, 3:13pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711/1 "2021-08-17T15:13:28Z")
Hi ELK community, I am a absolutely newbie in the Elasticsearch. I am getting a stuck in creating 2 pipelines towards 2 indexes of 2 log file (2 services in corresponding). My topo likes that: Filebeat ==\> logstash ==\> Elasticsearch==\> Kibana. In the filebeat.yml, i have a configuation to 2 files: (of course, I have comment output to Elasticsearch and uncomment to Logstash) ```auto filebeat.inputs: - type: log paths: - **/var/log/message** fields: {log_type: syslog} - type: log paths: - **/var/log/apache2/access.log** fields: apache: true fields_under_root: true ``` In the logstash-sample.conf file, I have 3 parts: - input ```auto input { beats { port => 5044 } } ``` - filter ```auto filter { if ([fields][log_type] == "syslog") { grok { match => { "message" => ['%{WORD:month} %{NUMBER:date} %{NOTSPACE:hour} %{NOTSPACE:hostname} %{GREEDYDATA:rest}'] } } } else if { grok { match => { "message" => ['%{COMBINEDAPACHELOG:message}'] } } } } ``` - Output ```auto output { if ([fields][log_type] == "sys") { elasticsearch { hosts => ["http://localhost:9200"] index => "test" } } else if ([fields][log_type] == "apa") { elasticsearch { hosts => ["http://localhost:9200"] index => "apach" } } } ``` Kindly help to figure out any my mistake and eventually, please help to share if you have any idea to approach my goal. P/S: With single pipeline, i can do well. Thanks in advance! ---
**Author:** ![MT2021](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@MT2021](https://discuss.elastic.co/u/MT2021)\ **Post date:** [August 17, 2021, 3:42pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711/2 "2021-08-17T15:42:48Z")
Additional information I got an issue. It seems it comes from pipeline and logstash configuration. Now Logstash is continuously restarting by itself ☹ ```auto Aug 17 22:36:21 thien-virtual-machine logstash[11138]: [2021-08-17T22:36:21,781][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"(\", \"!\", '\"', \"'\", \"-\", [0-9], \"[\", [A-Za-z_], '/' at line 17, column 11 (byte 345) after filter {\n if ([fields][log_type] == \"syslog\") {\n grok {\n match => { \"message\" => ['%{WORD:month} %{NUMBER:date} %{NOTSPACE:hour} %{NOTSPACE:hostname} %{GREEDYDATA:rest}'] }\n }\n }\n\n else if ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:391:in `block in converge_state'"]} ``` ---
**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\ **Post date:** [August 18, 2021, 1:51pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711/3 "2021-08-18T13:51:51Z")
> [@MT2021](#): > > `else if {` This condition is the source of your error. ---
**Author:** ![MT2021](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@MT2021](https://discuss.elastic.co/u/MT2021)\ **Post date:** [August 18, 2021, 2:05pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711/4 "2021-08-18T14:05:40Z")
i don't know what it should be. I have read some articles, **else if {** if correct format. ---
**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\ **Post date:** [August 18, 2021, 2:21pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711/5 "2021-08-18T14:21:11Z")
According to the [documentation](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) a `if` need to be followed by an expression. If you want to run the second grok plugin every time the `[fields][log_type]` don't contains `syslog` then only use `else {` ---
**Author:** ![MT2021](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@MT2021](https://discuss.elastic.co/u/MT2021)\ **Post date:** [August 18, 2021, 2:31pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711/6 "2021-08-18T14:31:10Z")
Thanks for your document. Let me try with **else** only. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 15, 2021, 2:31pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711/7 "2021-09-15T14:31:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.