# Logs from different sources in single txt file, to be stored in different indices using logstash

**URL:** <https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694>\
**Category:** Logstash\
**Created:** [October 14, 2021, 8:54am UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694 "2021-10-14T08:54:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Divyank\_Mahalle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divyank_mahalle/32/91240_2.png) [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\
**Post date:** [October 14, 2021, 8:54am UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694/1 "2021-10-14T08:54:14Z")

</div>

Hi,

I am having txt file consist of 3 different logs coming from 3 sources collated into single text file.

I want to separate out logs and stored them in a respective index.

Sample Logs-

```auto
10/12/2021 8:54:00 AM,MSGID: <..........> Mobile_Number:<.............>Job_no:<...............>User_id:<......> mstrGateWay <..........>
10/12/2021 8:54:03 AM,strDisplay: Message Id : <..........>Done Date : <..........>STAT : <..............>mstrGateWay: <................>

```

I got this link but still I need to confirm if this use case is possible or not.

https://www.elastic.co/blog/using-logstash-to-split-data-and-send-it-to-multiple-outputs

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 14, 2021, 1:43pm UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694/2 "2021-10-14T13:43:52Z")

</div>

Hi @Divyank_Mahalle

Yes it is possible, you will just need to determine the field or fields that will determine which index you want to route your logs to.

Sorting to different indices is a very common use case / pattern.

---

<div class="post-metadata">

**Author:** ![Mustafa\_NAJIB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustafa_najib/32/95797_2.png) [@Mustafa\_NAJIB](https://discuss.elastic.co/u/Mustafa_NAJIB)\
**Post date:** [October 14, 2021, 1:47pm UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694/3 "2021-10-14T13:47:18Z")

</div>

HELLO,  
i want to complet the reply of Mr @stephenb  
by this examlpe that you can use as your output

```auto
if [field1] == "..." { # or field1 exist
      elasticsearch {
          hosts => ["...", "...", "...", "...", "..."]
          index => "index1"
          ssl => true
          ...
		  ...
      }
     if [field2] == "..." { # or field2 exist
        elasticsearch {
          hosts => ["...", "...", "...", "...", "..."]
          index => "index2"
          ssl => true
          ...
		  ...
        }
      }
    }

```

---

<div class="post-metadata">

**Author:** ![Divyank\_Mahalle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divyank_mahalle/32/91240_2.png) [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\
**Post date:** [October 18, 2021, 1:19pm UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694/4 "2021-10-18T13:19:35Z")

</div>

Thanks @stephenb and @Mustafa_NAJIB for clearing the query 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2021, 1:19pm UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694/5 "2021-11-15T13:19:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.