# How to send logs from different filebeat to logstash

**URL:** <https://discuss.elastic.co/t/how-to-send-logs-from-different-filebeat-to-logstash/288305>\
**Category:** Logstash\
**Created:** [November 3, 2021, 9:20am UTC](https://discuss.elastic.co/t/how-to-send-logs-from-different-filebeat-to-logstash/288305 "2021-11-03T09:20:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 3, 2021, 9:20am UTC](https://discuss.elastic.co/t/how-to-send-logs-from-different-filebeat-to-logstash/288305/1 "2021-11-03T09:20:11Z")

</div>

I have configured Elasticsearch, kibana and logstash on same server. I want to send logs from multiple filebeat clients to logstash with different index name. How can I configure it?

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 6, 2021, 5:22am UTC](https://discuss.elastic.co/t/how-to-send-logs-from-different-filebeat-to-logstash/288305/2 "2021-11-06T05:22:38Z")

</div>

I have one centralized server in which we have configured Elasticsearch, Kibana and Logstash. And we have multiple clients in which filebeat is configured. I want to send logs from filebeat client to logstash. How can set different index name for all clients, so that we can get to know each client's logs seperately. Please guide me. I am beginner in ELK.

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [November 6, 2021, 2:27pm UTC](https://discuss.elastic.co/t/how-to-send-logs-from-different-filebeat-to-logstash/288305/3 "2021-11-06T14:27:05Z")

</div>

Hi,

The easiest way to do that, i think, is to add a tag in filebeat and create indexes, in logsatsh, with conditionals.

- add a tag to a filebeat configuration :

```auto
filebeat.inputs:
- type: log 
  paths:
    - example.log
  tags: ["filbeat1"]

```

- logstash configuration to create an index for each filebeat configuration :

```auto
filter {
  if "filebeat1" in [tags] {
    mutate { add_field => { "[@metadata][target_index]" => "filebeat1-%{+YYYY.MM.dd}" } }
  } else if "filebeat2" in [tags] {
    mutate { add_field => { "[@metadata][target_index]" => "filebeat2-%{+YYYY.MM.dd}" } }
  } else {
    mutate { add_field => { "[@metadata][target_index]" => "unknown-%{+YYYY.MM.dd}" } }
  }
}
output {
  elasticsearch {
    index => "%{[@metadata][target_index]}"
  }
}

```

Cad.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2021, 2:27pm UTC](https://discuss.elastic.co/t/how-to-send-logs-from-different-filebeat-to-logstash/288305/4 "2021-12-04T14:27:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.