# How to create multiple indexs with multiple input in logstash

**URL:** <https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416>\
**Category:** Logstash\
**Created:** [February 16, 2021, 11:09am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416 "2021-02-16T11:09:36Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 17, 2021, 12:14am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/4 "2021-02-17T00:14:02Z")

</div>

In your case you only ever index an event to one index. If you have three output that creates three sets of connections to elasticsearch. If you use a sprintf reference to set the index name then you only need one set.

```
filter {
    if [port] => "5140" {
        mutate { add_field => { "[@metadata][indexPrefix]" => "jstest1" } }
    } else if [port] => "5141" {
        mutate { add_field => { "[@metadata][indexPrefix]" => "jstest2" } }
    } else if [port] => "5142" {
        mutate { add_field => { "[@metadata][indexPrefix]" => "jstest3" } }
    }
}
output {
    if [@metadata][indexPrefix] {
        elasticsearch {
            hosts => ["https://xxxx:9200", "https://xxxx:9200"]
            user => "elastic"
            password => "xxxxxxxx"
            cacert => "/etc/logstash/certs/ca.crt"
            index => "%{[@metadata][indexPrefix]}-%{+YYYY.MM.dd}"
            action => "index"
        }
    }
}

```

As I said, that only works because one event only goes to one index. I cannot find it right now but someone recently asked a question where they had multiple elasticsearch outputs and the conditional for each one was `if "someTag" in [tags]`. That could result in an event going to multiple indexes, so those outputs could not be combined.

---

_[View the full topic](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416)._