Is it possible to create multiple index in single config file with different input locations?
yes
inputs have no bearing on you creating indexes
just like it uses in the eample logstash-%{yyyy.mmm.dd} you can %{filedname}-%{yyyy.mm.ddd} or wrap each elastisearch output in an if statement like
if [type] =~ /mytype/{
elasticsearch {
....
.....
index=> "mytype-today"
}
}else{
elasticsearch {
....
.....
index=>"allothertypes-today"
}
}
of course I think it would be better to use field names to sort your data. you can add a field on your file input
input {
file {
path=/var/log/message
add_field => { "dst_index" , "myindex" }
}
file {
path=>/var/log/audit
add_field => {"dst_index", "someotherindex"}
}
}
output{
elasticsearch{
....
.....
index=>"%{dst_index}-%{yyyy.mm.ddd}"
}
}
I like this way cause it provides the most flexibility,