# How to create multiple index from file beat log input in log-stash config
**URL:** https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144
**Category:** Beats
**Tags:** filebeat
**Created:** [April 3, 2019, 9:12am UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144 "2019-04-03T09:12:26Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)
#### Post date: [April 3, 2019, 9:12am UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/1 "2019-04-03T09:12:26Z")
How to configure multiple log files with different name in one logstash.conf instance.
I am using below configuration , with single files it is working fine ,but multiple file with different index name doesn't work.
FileBeat.yaml:
filebeat.inputs:
filebeat.prospectors:
- type: log
LogStash.conf:
input {
beats {
port =\> 5044
}
}
filter {
grok {
match =\> ["message","(?(([0-9]+)-_)+ ([0-9]+:_)+.\*)|%{WORD:LOGLEVEL}|%{WORD:LOGSOURCE}|%{GREEDYDATA:LOGMESSAGE}"]
}
}
output {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
manage\_template =\> false
index =\> "testlog-%{+YYYY.MM.dd}"
```
}
```
}
---
### Author:  [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)
#### Post date: [April 3, 2019, 4:05pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/2 "2019-04-03T16:05:47Z")
can you please fix formatting of the configuration files?
---
### Author:  [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)
#### Post date: [April 3, 2019, 4:29pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/3 "2019-04-03T16:29:07Z")
filebeat.yml:
```auto
filebeat.inputs:
filebeat.prospectors:
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
# - /var/log/*.log
- c:\logfile\*
#- c:\programdata\elasticsearch\logs\*
# Optional additional fields. These fields can be freely picked
# to add additional information to the crawled log files for filtering
fields:
level: debug
review: 1
forum: true
type: "logs1"
### Multiline options
# Multiline can be used for log messages spanning multiple lines. This is common
# for Java Stack Traces or C-Line Continuation
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
# Defines if the pattern set under pattern should be negated or not. Default is false.
multiline.negate: true
```
---
### Author:  [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)
#### Post date: [April 3, 2019, 4:30pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/4 "2019-04-03T16:30:34Z")
LogStash.conf:
# Sample Logstash configuration for creating a simple
# Beats -\> Logstash -\> Elasticsearch pipeline.
input {
beats {
port =\> 5044
}
}
filter {
grok {
match =\> ["message","(?(([0-9]+)-_)+ ([0-9]+:_)+.\*)|%{WORD:LOGLEVEL}|%{WORD:LOGSOURCE}|%{GREEDYDATA:LOGMESSAGE}"]
}
}
output {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
manage\_template =\> false
index =\> "teslog-%log-%{+YYYY.MM.dd}"
```
}
```
}
---
### Author:  [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)
#### Post date: [April 3, 2019, 4:34pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/5 "2019-04-03T16:34:04Z")
Hi [Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas),
Please find my formatted filebeat and logstash file.
I have a three log file with different name, I want to create index for these three file on the basis of their name or type.
---
### Author:  [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)
#### Post date: [April 3, 2019, 5:16pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/6 "2019-04-03T17:16:59Z")
maybe you can try playing with metadata and specifying index like
`index => "teslog-%{[@metadata][source]}-%{+YYYY.MM.dd}"`
or
`index => "teslog-%{[@metadata][_source]}-%{+YYYY.MM.dd}"`
I haven't tried this so please let me know if this works
---
### Author:  [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)
#### Post date: [April 3, 2019, 5:44pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/7 "2019-04-03T17:44:40Z")
Why we are using 'source' here
I tried this earlier with type and it doesn't work at that time.
I am new on ELK. Can you please try at your end?
---
### Author:  [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)
#### Post date: [April 4, 2019, 5:04am UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/8 "2019-04-04T05:04:22Z")
Hi [Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas),
I tried this , but its not working .
here is the index name created on elastic search:
teslog-%{[@metadata][source]}-2019.04.04
or
teslog-%{[@metadata][\_source]}-2019.04.04
---
### Author:  [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)
#### Post date: [April 8, 2019, 5:32am UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/9 "2019-04-08T05:32:44Z")
Hi Team,
Can anyone help e how to configure multiple index from filebeat input?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 6, 2019, 5:32am UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-from-file-beat-log-input-in-log-stash-config/175144/10 "2019-05-06T05:32:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.