# How to create multi indices with multi logs from filebeat?

**URL:** https://discuss.elastic.co/t/how-to-create-multi-indices-with-multi-logs-from-filebeat/130779
**Category:** Beats
**Tags:** filebeat
**Created:** [May 7, 2018, 6:16am UTC](https://discuss.elastic.co/t/how-to-create-multi-indices-with-multi-logs-from-filebeat/130779 "2018-05-07T06:16:52Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![alantany](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@alantany](https://discuss.elastic.co/u/alantany)
#### Post date: [May 7, 2018, 6:16am UTC](https://discuss.elastic.co/t/how-to-create-multi-indices-with-multi-logs-from-filebeat/130779/1 "2018-05-07T06:16:52Z")

</div>

Hi,  
Recently I use filebeat+logstash+ES (all is 6.x) to colect some logs ,I want diferent log create diferent index,how can I do with it?  
I read docs and said document\_type was deprecated in 6.x，So I configured with FIELDS in filebeat.yml

> ## filebeat: prospectors:
> 
> ```
> paths:
> - /var/log/cron-20180408
> input_type: log
> fields:
> logs_type: crontab
> 
> ```
> 
> - paths:  
> - /var/log/messages  
> input\_type: log  
> fields:  
> logs\_type: syslog
> 
> output:  
> logstash:  
> hosts: ["192.168.1.100:5044"]

configuration for logstash:

> input {  
> beats {  
> port =\> "5044"  
> }  
> }  
> filter {  
> }
> 
> output  
> {
> 
> if [fields][logs\_type] == "syslog"  
> {  
> elasticsearch  
> {  
> hosts =\> "192.168.1.200:9200"  
> index =\> "syslog"  
> }  
> }
> 
> else if [fields][logs\_type] == "crontab"  
> {  
> elasticsearch  
> {  
> hosts =\> "192.168.1.200:9200"  
> index =\> "crontab"  
> }

But Logstash could not create seperate indices for logs.  
Coud someone help me how to do it?  
Thank you very much!

---

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [May 8, 2018, 8:05pm UTC](https://discuss.elastic.co/t/how-to-create-multi-indices-with-multi-logs-from-filebeat/130779/2 "2018-05-08T20:05:39Z")

</div>

From what I see Logstash should correctly receive the `[fields][logs_type]` field, you should be able to use string interpolation in the Elasticsearch output definition. This change allows you to remove all the conditionals.

To dynamically change the ES index based on that field.

```auto
output {
hosts => "192.168.1.200:9200"
index => "%{[fields][logs_types]"
}

```

Be warned, creating more index requires shards.

---

<div class="post-metadata">

### Author: ![alantany](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@alantany](https://discuss.elastic.co/u/alantany)
#### Post date: [May 31, 2018, 8:22am UTC](https://discuss.elastic.co/t/how-to-create-multi-indices-with-multi-logs-from-filebeat/130779/3 "2018-05-31T08:22:05Z")

</div>

Thank you every much!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 28, 2018, 8:22am UTC](https://discuss.elastic.co/t/how-to-create-multi-indices-with-multi-logs-from-filebeat/130779/4 "2018-06-28T08:22:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.