# Logstash best practices for multiple sources
**URL:** https://discuss.elastic.co/t/logstash-best-practices-for-multiple-sources/303722
**Category:** Logstash
**Created:** [May 2, 2022, 8:43am UTC](https://discuss.elastic.co/t/logstash-best-practices-for-multiple-sources/303722 "2022-05-02T08:43:50Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@fropa](https://discuss.elastic.co/u/fropa)
#### Post date: [May 2, 2022, 8:43am UTC](https://discuss.elastic.co/t/logstash-best-practices-for-multiple-sources/303722/1 "2022-05-02T08:43:51Z")
Hi folks,
I'm starting to use ELK, I've multiple source servers, some of them have also multiple logs to send.
Now I'm trying to set up logstash sample configuration to just receive and send logs to the elasticsearch
I've the configuration :
> input {
> beats {
> port =\> 5044
> }
> }
>
> output {
>
> #X.X.X.X- nginx
> if "nginx-40.126" in [tags] {
> elasticsearch {
> hosts =\> ["[https://127.0.0.1:9200](https://127.0.0.1:9200)"]
> user =\> "elastic"
> password =\> "xxx.."
> cacert =\> "/etc/logstash/certs/ca.cer"
> index =\> "nginx-X.1"
> }
> }
>
> #X.X.X.2 tomcat
> if "tomcat-40.10" in [tags] {
> elasticsearch {
> hosts =\> ["[https://127.0.0.1:9200](https://127.0.0.1:9200)"]
> user =\> "elastic"
> password =\> "xxx.."
> cacert =\> "/etc/logstash/certs/ca.cer"
> index =\> "tomcat-X.2"
> }
> }
> }
and the configuration works, but I need to know if I can set up the connection to elasticsearch once and use it every time I need it. Or is that the best way to set up probably more than 100 sources? I mean config every log separately.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 2, 2022, 4:27pm UTC](https://discuss.elastic.co/t/logstash-best-practices-for-multiple-sources/303722/2 "2022-05-02T16:27:21Z")
Use conditionals in the filter section to set the index name and then use a sprintf reference in the Elasticsearch output. There is an example [here](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416/4). Note that the index option is ignored if ILM is enabled, which is on by default in recent versions.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 30, 2022, 4:27pm UTC](https://discuss.elastic.co/t/logstash-best-practices-for-multiple-sources/303722/3 "2022-05-30T16:27:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.