# Impossible to create a second index

**URL:** https://discuss.elastic.co/t/impossible-to-create-a-second-index/347627
**Category:** Logstash
**Created:** [November 21, 2023, 11:43am UTC](https://discuss.elastic.co/t/impossible-to-create-a-second-index/347627 "2023-11-21T11:43:53Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![Christian\_1974](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@Christian\_1974](https://discuss.elastic.co/u/Christian_1974)
#### Post date: [November 21, 2023, 1:25pm UTC](https://discuss.elastic.co/t/impossible-to-create-a-second-index/347627/5 "2023-11-21T13:25:53Z")

</div>

Hi, thanks

Ok, I explain that differently. I have two entry, in the input file. Yes. I have One entry in the output. Yeap. So, yes, "Syslog" and "cron" will be redirected in the same canal, the one I configured in the output. It shouldn't be a problem, I have a customer which have a similar configuration. That works well, apparently.

If that work for him, that should work for me. In first view, of course :). But, the problem, in my case, is that doesn't work, precisely. That turn in loop. As you can see in the logs I added in this thread :

```auto
Loop exited. Forcing reload

```

Anyway, I understand what you mean... I do not see the second index, because precisely I do not have a second output. Noted.

Ok... I can try to add another entry in my file "output". Something like that :

```auto
root@Big-Monster:/etc/logstash/conf.d# cat 99_output.conf
output {
  elasticsearch {
    id => "TEST-output-Syslog"
    hosts => ["127.0.0.1"]
    index => "syslog-%{+YYYY.MM.dd}"
    }

  elasticsearch {
    id => "TEST-output-Cron"
    hosts => ["127.0.0.1"]
    index => "Cron-%{+YYYY.MM.dd}"
    }
}

```

But how to make in sort the logs configured to the input "cron" be redirected to the output "cron" and not the output "syslog" ? Maybe we must have the same ID in both configuration input, ouput for cron, or something like that ? Maybe there is some subtility I missed.

Or I must, necessary, use multiple pipelines ? it is another question I asked here : [How to link input contain to output contain](https://discuss.elastic.co/t/how-to-link-input-contain-to-output-contain/347635)

Apologies, I am a newbe on ELK. I am precisely working to learn to use it. There is a lot of documentations, but it is not easy for me, stranger, to understand all. Even if I do my best 🙂

Best regards,  
Chris

---

_[View the full topic](https://discuss.elastic.co/t/impossible-to-create-a-second-index/347627)._