# How to define multiple indexes for different logs in Filebeat and Logstash?

**URL:** https://discuss.elastic.co/t/how-to-define-multiple-indexes-for-different-logs-in-filebeat-and-logstash/57498
**Category:** Beats
**Tags:** filebeat
**Created:** [August 8, 2016, 4:03pm UTC](https://discuss.elastic.co/t/how-to-define-multiple-indexes-for-different-logs-in-filebeat-and-logstash/57498 "2016-08-08T16:03:19Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![daiyue](https://avatars.discourse-cdn.com/v4/letter/d/bc8723/32.png) [@daiyue](https://discuss.elastic.co/u/daiyue)
#### Post date: [August 8, 2016, 4:03pm UTC](https://discuss.elastic.co/t/how-to-define-multiple-indexes-for-different-logs-in-filebeat-and-logstash/57498/1 "2016-08-08T16:03:19Z")

</div>

Hi, I have configured a log server, i.e. `Filebeat` -\> `Logstash` -\> `Elasticsearch` -\> `Kibana`. I am wondering how to create separated indexes for different logs (fetched using `Filebeat`) in `logstash` (which were later passed onto `elasticsearch`), so that in `kibana`, I can define two indexes for them and discover them.

In my case, I have a few client servers (each of which is installed with `filebeat`) and a centralized log server (`ELK`). Each client server has different kinds of logs, e.g. `redis.log`, `python` logs, `mongodb` logs, that I like to sort them into different indexes and stored in `elasticsearch`.

Each client server also serves different purposes, e.g. databases, UIs, applications. Hence I also like to give them different names to indicate the sources of the indexes (by changing output index in `filebeat.yml`?). So `redis.log` fetched from a production server will have an index name like prod.redis.

cheers

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 9, 2016, 4:10am UTC](https://discuss.elastic.co/t/how-to-define-multiple-indexes-for-different-logs-in-filebeat-and-logstash/57498/2 "2016-08-09T04:10:16Z")

</div>

Take a look at [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html), it's exactly what you want to do.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2016, 4:03pm UTC](https://discuss.elastic.co/t/how-to-define-multiple-indexes-for-different-logs-in-filebeat-and-logstash/57498/3 "2016-08-29T16:03:29Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.