# How to create multiple indexes from fields of JSON file from logstach

**URL:** <https://discuss.elastic.co/t/how-to-create-multiple-indexes-from-fields-of-json-file-from-logstach/203558>\
**Category:** Logstash\
**Created:** [October 15, 2019, 4:01am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexes-from-fields-of-json-file-from-logstach/203558 "2019-10-15T04:01:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaytran](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jaytran](https://discuss.elastic.co/u/jaytran)\
**Post date:** [October 15, 2019, 4:01am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexes-from-fields-of-json-file-from-logstach/203558/1 "2019-10-15T04:01:10Z")

</div>

hi all,

I'm a newone, I don't know how to create multiple index from fields in json.  
I have JSON File like this  
{ "id": "135569", "name" : "jay", "year":2016 , "companies": ["IBM", "Google"] }  
{ "id": "135570", "name" : "dave", "year":2019 , "companies": ["Dell", "HP", "Walmart"] }  
...  
now I want to create indexes based on "name" and "companies", please help me writing this script.  
thank you for any help.

---

<div class="post-metadata">

**Author:** ![jaytran](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jaytran](https://discuss.elastic.co/u/jaytran)\
**Post date:** [October 15, 2019, 10:55am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexes-from-fields-of-json-file-from-logstach/203558/2 "2019-10-15T10:55:17Z")

</div>

input {  
file {  
type =\> "json"  
path =\> "C:/Working/Sources/ES/data/test\_js.json"  
start\_position =\> "beginning"  
codec =\> "json"  
}  
}

filter {  
json {  
source =\> "message"  
}

output {  
stdout { codec =\> rubydebug }

elasticsearch{  
hosts =\> ["localhost:9200"]  
index =\> ["%{name}","%{companies}"]  
document\_type =\> "json"  
}  
}

I got below error when try to run above config file:  
[2019-10-15T17:42:02,252][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Something is wrong with your configuration."

if index =\> "%{name}" , it works well, it not allow to create multiple indexes, please help

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 15, 2019, 2:43pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexes-from-fields-of-json-file-from-logstach/203558/3 "2019-10-15T14:43:35Z")

</div>

> [@jaytran](#):
>
> if index =\> "%{name}" , it works well, it not allow to create multiple indexes, please help

If you want to write data to more than one index you must have more than one elasticsearch output. Try

```
output {
    stdout { codec => rubydebug }

    elasticsearch{
        hosts => ["localhost:9200"]
        index => "%{name}"
        document_type => "json"
    }

    elasticsearch{
        hosts => ["localhost:9200"]
        index => "%{companies}"
        document_type => "json"
    }
}

```

---

<div class="post-metadata">

**Author:** ![jaytran](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jaytran](https://discuss.elastic.co/u/jaytran)\
**Post date:** [October 16, 2019, 2:02am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexes-from-fields-of-json-file-from-logstach/203558/4 "2019-10-16T02:02:10Z")

</div>

> [@Badger](#):
>
> elasticsearch{ hosts =\> ["localhost:9200"] index =\> "%{companies}" document\_type =\> "json" }

Great, thanks Badger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2019, 2:03am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexes-from-fields-of-json-file-from-logstach/203558/5 "2019-11-13T02:03:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.