# How to link input contain to output contain

**URL:** https://discuss.elastic.co/t/how-to-link-input-contain-to-output-contain/347635
**Category:** Logstash
**Created:** [November 21, 2023, 12:23pm UTC](https://discuss.elastic.co/t/how-to-link-input-contain-to-output-contain/347635 "2023-11-21T12:23:10Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 21, 2023, 1:01pm UTC](https://discuss.elastic.co/t/how-to-link-input-contain-to-output-contain/347635/2 "2023-11-21T13:01:30Z")

</div>

This seems to be related to your previous [question](https://discuss.elastic.co/t/impossible-to-create-a-second-index/347627/4), please avoid opening duplicate questions.

If you want data from your syslog file to go th the `syslog-YYYY.MM.dd` index and data from your cron file to go to the `cron-YYYY.MM.dd` index, the best approach is to use [multiple pipelines](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html).

You will need one pipeline for your syslog file and another one to your cron file.

For example, you can have a `syslog.conf` and `cron.conf`

`syslog.conf`

```auto
input {
  file {
    id => "TEST-Syslog"
    path => ["/var/log/syslog"]
  }
}

output {
  elasticsearch {
    id => "TEST-output-Syslog"
    hosts => ["127.0.0.1"]
    index => "syslog-%{+YYYY.MM.dd}"
  }
}

```

and

`cron.conf`

```auto
input {
  file {
    id => "TEST-Cron"
    path => ["/var/log/cron.log"]
  }
}

output {
  elasticsearch {
    id => "TEST-output-Cron"
    hosts => ["127.0.0.1"]
    index => "cron-%{+YYYY.MM.dd}"
  }
}

```

Then you should update your `pipelines.yml` to this one:

```auto
- pipeline.id: syslog
  path.config: "/etc/logstash/conf.d/syslog.conf"
- pipeline.id: cron
  path.config: "/etc/logstash/conf.d/cron.conf"

```

---

_[View the full topic](https://discuss.elastic.co/t/how-to-link-input-contain-to-output-contain/347635)._