# How to push same document into multiple indexes?

**URL:** <https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121>\
**Category:** Logstash\
**Created:** [August 20, 2018, 9:24am UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121 "2018-08-20T09:24:25Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rohlik](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@Rohlik](https://discuss.elastic.co/u/Rohlik)\
**Post date:** [August 20, 2018, 9:24am UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121/1 "2018-08-20T09:24:25Z")

</div>

Hello,  
I collecting logs via TCP input and I want specific log to be in `logstash` index and also in `monitoring` index. But logs with `"time" in [tags]` are only in monitoring index, not logstash. Why?

My Logstash output config look like:

```auto
output {
    if "time" in [tags] {
      elasticsearch {
    hosts => ["192.168.1.1:9200"]
    index => "monitoring-%{+YYYY.ww}"
      }
    }
    else if [appname] == "java" {
     elasticsearch {
    hosts => ["192.168.1.1:9200"]
    index => "java-%{+YYYY.MM.dd}"
      }
    }
    else if [appname] != "java" {
      elasticsearch {
    hosts => ["192.168.1.1:9200"]
    index => "logstash-%{+YYYY.MM.dd}"
      }
     }
    }

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 12:31pm UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121/2 "2018-08-20T12:31:58Z")

</div>

> But logs with `"time" in [tags]` are only in monitoring index, not logstash. Why?

Because that's how `if ... else` conditionals work. If the first condition is true the event will be sent to the monitoring index and the other conditions won't be considered at all.

---

<div class="post-metadata">

**Author:** ![Rohlik](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@Rohlik](https://discuss.elastic.co/u/Rohlik)\
**Post date:** [August 20, 2018, 1:35pm UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121/3 "2018-08-20T13:35:45Z")

</div>

Thank you for your answer. Is there any approach how I can achieve what I need?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 1:59pm UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121/4 "2018-08-20T13:59:53Z")

</div>

Yes, but it's not clear exactly what you need. I _think_ you're looking for this:

- If the event has the tag "time" send it to the monitoring index.
- If the event's `appname` field is "java" send to the java index, else send to the logstash index.

---

<div class="post-metadata">

**Author:** ![Rohlik](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@Rohlik](https://discuss.elastic.co/u/Rohlik)\
**Post date:** [August 21, 2018, 9:44am UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121/5 "2018-08-21T09:44:19Z")

</div>

- If the event has the tag "time" send it to the monitoring index AND to the logstash index.
- If the event's `appname` field is "java" send to the java index
- Everything else send to the logstash index.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 21, 2018, 11:29am UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121/6 "2018-08-21T11:29:29Z")

</div>

That's basically what I said, and it's obvious that describing such logical conditions with prose easily turns ambiguous.

I'm not sure what to do here. I could suggest something that satisfies what I think you want, but if you're not at all familiar with conditionals I don't know if that helps.

---

<div class="post-metadata">

**Author:** ![Rohlik](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@Rohlik](https://discuss.elastic.co/u/Rohlik)\
**Post date:** [August 22, 2018, 12:17pm UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121/7 "2018-08-22T12:17:31Z")

</div>

Thank you for your time and for your advice. I was able to set what I need with this setting:

```
output {
    if "time" in [tags] {
      elasticsearch {
    hosts => ["192.168.1.1:9200"]
    index => "monitoring-%{+YYYY.ww}"
      }
      elasticsearch {
    hosts => ["192.168.1.1:9200"]
    index => "logstash-%{+YYYY.ww}"
      }
    }
    else if [appname] == "java" {
     elasticsearch {
    hosts => ["192.168.1.1:9200"]
    index => "java-%{+YYYY.MM.dd}"
      }
    }
    else if [appname] != "java" {
      elasticsearch {
    hosts => ["192.168.1.1:9200"]
    index => "logstash-%{+YYYY.MM.dd}"
      }
     }
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2018, 12:25pm UTC](https://discuss.elastic.co/t/how-to-push-same-document-into-multiple-indexes/145121/8 "2018-09-19T12:25:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.