# How send the log to different index in Kibana
**URL:** https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817
**Category:** Logstash
**Created:** [April 13, 2020, 6:57pm UTC](https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817 "2020-04-13T18:57:32Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Prabhu\_Chinnasamy](https://discuss.elastic.co/u/Prabhu_Chinnasamy)
#### Post date: [April 13, 2020, 6:57pm UTC](https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817/1 "2020-04-13T18:57:32Z")
I am new to Elastic stack and trying to see the different logs under different Kiban indexes. for an example, I am trying to place the logs from my dhcp server under a index called "DHCP". My logstash config is as below, but I am not seeing the new index created for DHCP and still all the logs are going under the default filebeat index.
''''''''''''''''''''''''''''''''''''
input {
beats {
port =\> 5044
}
}
output {
if [log.file.path] in [C:\Windows\system32\dhcp\*]{
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "DHCP-%{+YYYY.MM.dd}"
user =\> "CCCCCC"
password =\> "CCCCCC"
}
}else {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
user =\> "CCCCCC"
password =\> "XXXXXXXXX"
}
}
}
''''''''''''''''''''''''''''''
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 13, 2020, 6:58pm UTC](https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817/2 "2020-04-13T18:58:29Z")
> [@Prabhu\_Chinnasamy](#):
>
> [log.file.path]
In logstash you have to refer to that as [log][file][path]
---
### Author:  [@Prabhu\_Chinnasamy](https://discuss.elastic.co/u/Prabhu_Chinnasamy)
#### Post date: [April 13, 2020, 7:02pm UTC](https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817/3 "2020-04-13T19:02:10Z")
so should I modify my config as below?
if [log] [file] [path] in [C:\Windows\system32\dhcp\*]{
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200/)"]
index =\> "DHCP-%{+YYYY.MM.dd}"
user =\> "CCCCCC"
password =\> "CCCCCC"
---
### Author:  [@Prabhu\_Chinnasamy](https://discuss.elastic.co/u/Prabhu_Chinnasamy)
#### Post date: [April 13, 2020, 7:10pm UTC](https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817/4 "2020-04-13T19:10:55Z")
Changed the config file in logstash but still not seeing the new index in kibana.
my new config file:
input {
beats {
port =\> 5044
}
}
output {
if [log][file][path] in [C:\Windows\system32\dhcp\*]{
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "DHCP-%{+YYYY.MM.dd}"
user =\> "elastic"
password =\> "fgdgdfhfgh"
}
}else {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
user =\> "elastic"
password =\> "sdfsdfdfg"
}
}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 13, 2020, 8:27pm UTC](https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817/5 "2020-04-13T20:27:21Z")
> [@Prabhu\_Chinnasamy](#):
>
> if [log][file][path] in [C:\Windows\system32\dhcp\*]{
That should be either
```
if [log][file][path] =~ /C:\\Windows\\system32\\dhcp/ {
```
or
```
if "C:\Windows\system32\dhcp" in [log][file][path] {
```
---
### Author:  [@Prabhu\_Chinnasamy](https://discuss.elastic.co/u/Prabhu_Chinnasamy)
#### Post date: [April 13, 2020, 9:20pm UTC](https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817/6 "2020-04-13T21:20:05Z")
Thanks, Badger.
As you suggested, I have used "if "C:\Windows\system32\dhcp" in [log][file][path] {" and it worked.
Now I see the new index created in Kibana.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 11, 2020, 9:20pm UTC](https://discuss.elastic.co/t/how-send-the-log-to-different-index-in-kibana/227817/7 "2020-05-11T21:20:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.