# Kibana index shows same data

**URL:** <https://discuss.elastic.co/t/kibana-index-shows-same-data/145289>\
**Category:** Kibana\
**Created:** [August 21, 2018, 6:07am UTC](https://discuss.elastic.co/t/kibana-index-shows-same-data/145289 "2018-08-21T06:07:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dasun\_Hettiarachchi](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Dasun\_Hettiarachchi](https://discuss.elastic.co/u/Dasun_Hettiarachchi)\
**Post date:** [August 21, 2018, 6:07am UTC](https://discuss.elastic.co/t/kibana-index-shows-same-data/145289/1 "2018-08-21T06:07:18Z")

</div>

hey folks, i have logstash running on my server collecting nginx and magento logs, here are my confs

logstash-magento-es.conf  
input {  
file {  
type =\> "mageto2"  
path =\> ["/var/www/html/current/var/log/system.log"]  
}  
}  
filter {  
if [type] == "magento2" {  
grok {  
match =\> { "message" =\> "[%{TIMESTAMP\_ISO8601:timestamp}] %{DATA:log\_level}: %{GREEDYDATA:message}"}  
add\_field =\> ["received\_at", "%{@timestamp}"]  
}  
}  
if [type] == "magento1" {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:date} %{DATA:log\_level} ([0-9]+): %{GREEDYDATA:message}"}  
add\_field =\> ["received\_at", "%{@timestamp}"]  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "magento-syslogs-frontend-%{+YYYY.MM.dd}"  
document\_type =\> "magento\_logs"  
}  
}

logstash-nginx-es.conf

input {  
beats {  
host =\> "0.0.0.0"  
port =\> 5400  
}  
}

filter {  
grok {  
match =\> ["message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra\_fields}"]  
overwrite =\> ["message"]  
}

mutate {  
remove\_field =\> ["[host]" ]  
}

mutate {  
convert =\> ["response", "integer"]  
convert =\> ["bytes", "integer"]  
convert =\> ["responsetime", "float"]  
}  
geoip {  
source =\> "clientip"  
target =\> "geoip"  
add\_tag =\> ["nginx-geoip"]  
}  
date {  
match =\> ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]  
remove\_field =\> ["timestamp"]  
}  
useragent {  
source =\> "agent"  
}  
}

output {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "weblogs-frontend-%{+YYYY.MM.dd}"  
document\_type =\> "nginx\_logs"  
}  
}

everything works fine. but when i create two index on kibana for those two logs, i get same data in both indexs. i cannot seems to find why. what would be the reason?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 21, 2018, 6:48am UTC](https://discuss.elastic.co/t/kibana-index-shows-same-data/145289/2 "2018-08-21T06:48:30Z")

</div>

Logstash concatenates all config files in the directory, so the data from all inputs will go to all outputs unless you control this through [conditionals](https://www.elastic.co/guide/en/logstash/6.3/event-dependent-configuration.html) or use the [multi-pipeline feature](https://www.elastic.co/guide/en/logstash/6.3/multiple-pipelines.html) to separate them. This is a common misunderstanding, so you should be able to find multiple other threads discussing this here.

---

<div class="post-metadata">

**Author:** ![Dasun\_Hettiarachchi](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Dasun\_Hettiarachchi](https://discuss.elastic.co/u/Dasun_Hettiarachchi)\
**Post date:** [August 21, 2018, 7:32am UTC](https://discuss.elastic.co/t/kibana-index-shows-same-data/145289/3 "2018-08-21T07:32:31Z")

</div>

reconfigured with pipelines and works like charm!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2018, 7:32am UTC](https://discuss.elastic.co/t/kibana-index-shows-same-data/145289/4 "2018-09-18T07:32:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.