# How to create multiple indexs with multiple input in logstash
**URL:** https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416
**Category:** Logstash
**Created:** [February 16, 2021, 11:09am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416 "2021-02-16T11:09:36Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [February 16, 2021, 11:09am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/1 "2021-02-16T11:09:36Z")
I would like to have some help to configure multiple indexes from multiple entries with logstash.
Is my configuration below correct?
input {
tcp {
port =\> "5140"
codec =\> json
type =\> "syslog"
}
tcp {
port =\> "5141"
codec =\> json
type =\> "syslog"
}
tcp {
port =\> "5142"
codec =\> json
type =\> "syslog"
}
}
filter {
grok {
match =\> { "message" =\> "%{SYSLOG5424PRI:syslog\_index}-\s\*%{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:syslog\_message}" }
}
json {
source =\> "syslog\_message"
}
}
output {
stdout { codec =\> rubydebug }
if port =\> "5140" {
elasticsearch {
hosts =\> ["[https://xxxx:9200](https://xxxx:9200)", "[https://xxxx:9200](https://xxxx:9200)"]
user =\> "elastic"
password =\> "xxxxx"
cacert =\> "/etc/logstash/certs/ca.crt"
index =\> "jstest1-%{+YYYY.MM.dd}"
action =\> "index"
}
}
if port =\> "5141" {
elasticsearch {
hosts =\> ["[https://xxxxx:9200](https://xxxxx:9200)", "[https://xxxxx:9200](https://xxxxx:9200)"]
user =\> "elastic"
password =\> "xxxx"
cacert =\> "/etc/logstash/certs/ca.crt"
index =\> "jstest2-%{+YYYY.MM.dd}"
action =\> "index"
}
}
if port =\> "5142" {
elasticsearch {
hosts =\> ["[https://xxxx:9200](https://xxxx:9200)", "[https://xxxx:9200](https://xxxx:9200)"]
user =\> "elastic"
password =\> "xxxxxxxx"
cacert =\> "/etc/logstash/certs/ca.crt"
index =\> "jstest3-%{+YYYY.MM.dd}"
action =\> "index"
}
}
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 16, 2021, 11:15pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/2 "2021-02-16T23:15:41Z")
I would try changing your `if port` to `if type`.
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [February 16, 2021, 11:24pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/3 "2021-02-16T23:24:27Z")
You can also use the [@metadata field](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#metadata). Concept is you add an @metadata field to each of your inputs. Use the conditional on your output. Then the field is deleted and not sent to Elastic automatically.
```auto
add_field => { "[@metadata][tag]" => "give it a name" }
```
```auto
if [@metadata][tag] == "give it a name" {
// do your output for that input
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 17, 2021, 12:14am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/4 "2021-02-17T00:14:02Z")
In your case you only ever index an event to one index. If you have three output that creates three sets of connections to elasticsearch. If you use a sprintf reference to set the index name then you only need one set.
```
filter {
if [port] => "5140" {
mutate { add_field => { "[@metadata][indexPrefix]" => "jstest1" } }
} else if [port] => "5141" {
mutate { add_field => { "[@metadata][indexPrefix]" => "jstest2" } }
} else if [port] => "5142" {
mutate { add_field => { "[@metadata][indexPrefix]" => "jstest3" } }
}
}
output {
if [@metadata][indexPrefix] {
elasticsearch {
hosts => ["https://xxxx:9200", "https://xxxx:9200"]
user => "elastic"
password => "xxxxxxxx"
cacert => "/etc/logstash/certs/ca.crt"
index => "%{[@metadata][indexPrefix]}-%{+YYYY.MM.dd}"
action => "index"
}
}
}
```
As I said, that only works because one event only goes to one index. I cannot find it right now but someone recently asked a question where they had multiple elasticsearch outputs and the conditional for each one was `if "someTag" in [tags]`. That could result in an event going to multiple indexes, so those outputs could not be combined.
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [February 18, 2021, 10:24am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/5 "2021-02-18T10:24:07Z")
Hello aaron-nimocks,
How do you find this configuration?
input {
tcp {
port =\> "5140"
codec =\> json
tags =\> ["client1"]
}
tcp {
port =\> "5141"
codec =\> json
tags =\> ["client2"]
}
tcp {
port =\> "5142"
codec =\> json
tags =\> ["client3"]
}
}
filter {
grok {
match =\> { "message" =\> "%{SYSLOG5424PRI:syslog\_index}-\s\*%{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:syslog\_message}" }
}
json {
source =\> "syslog\_message"
}
if [port] =\> "5140" {
mutate { add\_field =\> { "[@metadata][indexPrefix]" =\> "jstest1" } }
} else if [port] =\> "5141" {
mutate { add\_field =\> { "[@metadata][indexPrefix]" =\> "jstest2" } }
} else if [port] =\> "5142" {
mutate { add\_field =\> { "[@metadata][indexPrefix]" =\> "jstest3" } }
}
}
output {
stdout { codec =\> rubydebug }
if "client1" in [tags] {
elasticsearch {
hosts =\> ["[https://xxxx:9200](https://xxxx:9200)", "[https://xxxx:9200](https://xxxx:9200)"]
user =\> "elastic"
password =\> "xxxxx"
cacert =\> "/etc/logstash/certs/ca.crt"
index =\> "jstest1-%{+YYYY.MM.dd}"
action =\> "index"
}
}
if "client2" in [tags] {
elasticsearch {
hosts =\> ["[https://xxxx:9200](https://xxxx:9200)", "[https://xxxx:9200](https://xxxx:9200)"]
user =\> "elastic"
password =\> "xxxxx"
cacert =\> "/etc/logstash/certs/ca.crt"
index =\> "jstest2-%{+YYYY.MM.dd}"
action =\> "index"
}
}
if "client3" in [tags] {
elasticsearch {
hosts =\> ["[https://xxxx:9200](https://xxxx:9200)", "[https://xxxx:9200](https://xxxx:9200)"]
user =\> "elastic"
password =\> "xxxxx"
cacert =\> "/etc/logstash/certs/ca.crt"
index =\> "jstest3-%{+YYYY.MM.dd}"
action =\> "index"
}
}
}
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [February 18, 2021, 10:26am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/6 "2021-02-18T10:26:56Z")
Hello Badger,
How do you find this configuration?
input {
tcp {
port =\> "5140"
codec =\> json
tags =\> ["client1"]
}
tcp {
port =\> "5141"
codec =\> json
tags =\> ["client2"]
}
tcp {
port =\> "5142"
codec =\> json
tags =\> ["client3"]
}
}
filter {
grok {
match =\> { "message" =\> "%{SYSLOG5424PRI:syslog\_index}-\s\*%{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:syslog\_message}" }
}
json {
source =\> "syslog\_message"
}
if [port] =\> "5140" {
mutate { add\_field =\> { "[@metadata][indexPrefix]" =\> "jstest1" } }
} else if [port] =\> "5141" {
mutate { add\_field =\> { "[@metadata][indexPrefix]" =\> "jstest2" } }
} else if [port] =\> "5142" {
mutate { add\_field =\> { "[@metadata][indexPrefix]" =\> "jstest3" } }
}
}
output {
if [@metadata][indexPrefix] {
elasticsearch {
hosts =\> ["[https://xxxx:9200](https://xxxx:9200)", "[https://xxxx:9200](https://xxxx:9200)"]
user =\> "elastic"
password =\> "xxxxxxxx"
cacert =\> "/etc/logstash/certs/ca.crt"
index =\> "%{[@metadata][indexPrefix]}-%{+YYYY.MM.dd}"
action =\> "index"
}
}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 18, 2021, 4:50pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/7 "2021-02-18T16:50:50Z")
It looks reasonable. The question is ... does it do what you want?
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [February 19, 2021, 9:06am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/8 "2021-02-19T09:06:02Z")
> [@Badger](#):
>
> It looks reasonable. The question is ... does it do what you want?
I will test to see
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 19, 2021, 9:06am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/9 "2021-03-19T09:06:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.