# How to divide data from one agent into two indexes?

**URL:** <https://discuss.elastic.co/t/how-to-divide-data-from-one-agent-into-two-indexes/196360>\
**Category:** Logstash\
**Created:** [August 22, 2019, 3:53pm UTC](https://discuss.elastic.co/t/how-to-divide-data-from-one-agent-into-two-indexes/196360 "2019-08-22T15:53:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![psyapathy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psyapathy/32/50265_2.png) [@psyapathy](https://discuss.elastic.co/u/psyapathy)\
**Post date:** [August 22, 2019, 3:53pm UTC](https://discuss.elastic.co/t/how-to-divide-data-from-one-agent-into-two-indexes/196360/1 "2019-08-22T15:53:33Z")

</div>

Hello!  
I have a Windows server, it is winlogbeat, data is sent to Elasticsearch via Logstash.  
I'm getting data from the security log and sysmon.

All this data is sent to the index "index1". But there is data, which have event.action equals "Test". I want to receive data with event.action="Test" to "index2".

**My output.conf for Logstash now:**

> ```
> output {
> if "winserv1" in [tags {
> elasticsearch {
> hosts => "localhost:9200"
> index => "index1-%{+YYYY.MM.dd}" 
> }
> }
> }
> 
> ```

Help me pleas.

I try:

> ```
> output {
> if "winserv1" in [tags {
> elasticsearch {
> hosts => "localhost:9200"
> index => "index1-%{+YYYY.MM.dd}" 
> }
> }else if "Test" in [event.action]{
> elasticsearch {
> hosts => "localhost:9200"
> index => "index2-%{+YYYY.MM.dd}" 
> }
> }
> }
> 
> ```

But it doesn't work..

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 22, 2019, 6:03pm UTC](https://discuss.elastic.co/t/how-to-divide-data-from-one-agent-into-two-indexes/196360/2 "2019-08-22T18:03:10Z")

</div>

Do you have a dot in the field name or an object called event that contains an action field. If the latter then use [event][action]

You could also use

```
filter {
    if "winserv1" in [tags] {
        mutate { add_field => { "[@metadata][index]" => "index1-%{+YYYY.MM.dd}" } }
    } else if "Test" in [event.action] {
        mutate { add_field => { "[@metadata][index]" => "index2-%{+YYYY.MM.dd}" } }
    }
}
output {
     elasticsearch {
         hosts => "localhost:9200"
         index => "[@metadata][index]"
     }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2019, 6:03pm UTC](https://discuss.elastic.co/t/how-to-divide-data-from-one-agent-into-two-indexes/196360/3 "2019-09-19T18:03:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.