# Logstash loops
**URL:** https://discuss.elastic.co/t/logstash-loops/158750
**Category:** Logstash
**Created:** [November 29, 2018, 12:01pm UTC](https://discuss.elastic.co/t/logstash-loops/158750 "2018-11-29T12:01:17Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@dinesh1](https://discuss.elastic.co/u/dinesh1)
#### Post date: [November 29, 2018, 12:01pm UTC](https://discuss.elastic.co/t/logstash-loops/158750/1 "2018-11-29T12:01:18Z")
Hi,
how to use loops for output in logstash.
output {
```
if [my_index] == "order"{
elasticsearch {
hosts => ["172.160.0.234"]
index => "order-%{+YYYY.MM.dd}"
}
}
if [my_index] == "merchant"{
elasticsearch {
hosts => ["172.160.0.234}"]
index => "merchant-%{+YYYY.MM.dd}"
}
}
if [my_index] == "service"{
elasticsearch {
hosts => ["172.160.0.234"]
index => "service-%{+YYYY.MM.dd}"
}
}
if [my_index] == "reorder"{
elasticsearch {
hosts => ["172.160.0.234}"]
index => "reorder-%{+YYYY.MM.dd}"
}
}
else {
elasticsearch {
hosts => ["172.160.0.234}"]
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
}
}
stdout { codec => rubydebug }
```
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 29, 2018, 12:03pm UTC](https://discuss.elastic.co/t/logstash-loops/158750/2 "2018-11-29T12:03:17Z")
Why would you need loops? What is the problem you are trying to solve?
---
### Author:  [@dinesh1](https://discuss.elastic.co/u/dinesh1)
#### Post date: [November 29, 2018, 12:11pm UTC](https://discuss.elastic.co/t/logstash-loops/158750/3 "2018-11-29T12:11:13Z")
I had 12 docker containers, I need to create seperate indices for each container.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 29, 2018, 12:11pm UTC](https://discuss.elastic.co/t/logstash-loops/158750/4 "2018-11-29T12:11:46Z")
Why?
---
### Author:  [@dinesh1](https://discuss.elastic.co/u/dinesh1)
#### Post date: [November 29, 2018, 12:15pm UTC](https://discuss.elastic.co/t/logstash-loops/158750/5 "2018-11-29T12:15:23Z")
To reduce indices size, usually it is morethan 100gb perday
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 29, 2018, 12:47pm UTC](https://discuss.elastic.co/t/logstash-loops/158750/6 "2018-11-29T12:47:10Z")
You do not necessarily need multiple outputs (which can be inefficient) and can do something like this:
```auto
filter {
if [my_index] == "order"{
mutate { add_field => { "[@metadata][prefix]" => "order" } }
} else if [my_index] == "merchant" {
mutate { add_field => { "[@metadata][prefix]" => "merchant" } }
...
} else {
mutate { add_field => { "[@metadata][prefix]" => "%{[@metadata][beat]}" } }
}
}
output {
elasticsearch {
index => "%{[@metadata][prefix]}-%{+YYYY.MM.dd}"
}
}
```
---
### Author:  [@dinesh1](https://discuss.elastic.co/u/dinesh1)
#### Post date: [November 30, 2018, 8:49am UTC](https://discuss.elastic.co/t/logstash-loops/158750/7 "2018-11-30T08:49:44Z")
Thanks for your help
I had one more query in above filter, using if condition is ok for 2 0r 3 items(like order , merchant).
But if i have 8 items then how to do...?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 30, 2018, 9:08am UTC](https://discuss.elastic.co/t/logstash-loops/158750/8 "2018-11-30T09:08:19Z")
Either expand it (I cut it short to save space) or perhaps try using the translate plugin to set the field.
---
### Author:  [@dinesh1](https://discuss.elastic.co/u/dinesh1)
#### Post date: [December 12, 2018, 11:29am UTC](https://discuss.elastic.co/t/logstash-loops/158750/9 "2018-12-12T11:29:19Z")
actually my requirement is to get logs based on condition if condition fails it should be in else part, but in my case last indices that is filebeat-yyyy-xx-xx contains all logs...
filter {
if [my\_index] == "order"{
mutate { add\_field =\> { "[@metadata][prefix]" =\> "order" } }
} else if [my\_index] == "merchant" {
mutate { add\_field =\> { "[@metadata][prefix]" =\> "merchant" } }
...
} else {
mutate { add\_field =\> { "[@metadata][prefix]" =\> "%{[@metadata][beat]}" } }
}
}
output {
elasticsearch {
index =\> "%{[@metadata][prefix]}-%{+YYYY.MM.dd}"
}
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 11:45am UTC](https://discuss.elastic.co/t/logstash-loops/158750/10 "2018-12-12T11:45:08Z")
Check what your data looks like and why the conditions in that case appear to be failing.
---
### Author:  [@dinesh1](https://discuss.elastic.co/u/dinesh1)
#### Post date: [December 12, 2018, 11:57am UTC](https://discuss.elastic.co/t/logstash-loops/158750/11 "2018-12-12T11:57:18Z")
How can i get @metadata field in kibana
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 12:04pm UTC](https://discuss.elastic.co/t/logstash-loops/158750/12 "2018-12-12T12:04:16Z")
You can not, but you can look at the fields used in the conditionals populating it , e.g. the `my_index` field in the example above. If this does not exist or is at the wrong level, everything will go to the else clause. If you can show an event that has ended up in the wrong index, we might be able to help.
---
### Author:  [@dinesh1](https://discuss.elastic.co/u/dinesh1)
#### Post date: [December 13, 2018, 5:47am UTC](https://discuss.elastic.co/t/logstash-loops/158750/13 "2018-12-13T05:47:17Z")
condition is working fine, may be there will be two @metadata I guess in each log.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 13, 2018, 6:21am UTC](https://discuss.elastic.co/t/logstash-loops/158750/14 "2018-12-13T06:21:29Z")
I do not understand. Can you please show your config and an example of a document that goes to the incorrect index?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 10, 2019, 6:21am UTC](https://discuss.elastic.co/t/logstash-loops/158750/15 "2019-01-10T06:21:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.