# If/Else condition for Output to Elasticsearch

**URL:** https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [June 14, 2021, 6:16am UTC](https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790 "2021-06-14T06:16:22Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![valhalla](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@valhalla](https://discuss.elastic.co/u/valhalla)
#### Post date: [June 14, 2021, 6:16am UTC](https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790/1 "2021-06-14T06:16:22Z")

</div>

Hi team,

Would like to ask for your help with regards on having an `if else` condition on Filebeat’s output to elasticsearch. Would like to check `if fields.age ==10` the output to be one array of hosts else other array of hosts

```auto
If fields.age ==10:
  Output.elasticsearch:
     Hosts:[“http:es01:9200”]

Else:
   Output.elasticsearch:
      Hosts: [“es01:9200, es02:9200”]

```

As you can see what I want to do is to check if a variable from an XPATH equals a value.

Thank you for your answer!

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [June 14, 2021, 8:29am UTC](https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790/2 "2021-06-14T08:29:07Z")

</div>

Hi @valhalla!

I'm afraid you cannot set conditions on host's level. What you can is to use conditions in index'es level ([Configure the Elasticsearch output | Filebeat Reference [7.13] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#indices-option-es)).

C.

---

<div class="post-metadata">

### Author: ![valhalla](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@valhalla](https://discuss.elastic.co/u/valhalla)
#### Post date: [June 14, 2021, 8:39am UTC](https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790/3 "2021-06-14T08:39:29Z")

</div>

Thank you Chris!

Can be set conditions on Logstash’s output? Can the same be done in Logstash, but with if/else conditions?

Thank you in advance!

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [June 14, 2021, 9:01am UTC](https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790/4 "2021-06-14T09:01:32Z")

</div>

Filebeat does not support sending to multiple outputs, you can find more info about this at [Support multiple outputs of the same type (like two independent Logstash clusters) · Issue #1035 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/1035).

You can define conditional-like ES indexes in Logstash which is described at [Elasticsearch output plugin | Logstash Reference [7.13] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html).

In general, it seems that the only way to achieve sending to multiple hosts is to use 2 different Filebeat instances.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2021, 11:01am UTC](https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790/5 "2021-07-12T11:01:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
