# Logstash output: If field exists, use other index

**URL:** <https://discuss.elastic.co/t/logstash-output-if-field-exists-use-other-index/141958>\
**Category:** Logstash\
**Created:** [July 27, 2018, 2:51pm UTC](https://discuss.elastic.co/t/logstash-output-if-field-exists-use-other-index/141958 "2018-07-27T14:51:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![johann](https://avatars.discourse-cdn.com/v4/letter/j/54ee81/32.png) [@johann](https://discuss.elastic.co/u/johann)\
**Post date:** [July 27, 2018, 2:51pm UTC](https://discuss.elastic.co/t/logstash-output-if-field-exists-use-other-index/141958/1 "2018-07-27T14:51:57Z")

</div>

Hi all,

I want to use an other index, if a specific field exists...

My output-config looks like this:

```
output {
  if [kubernetes.namespace] {
    elasticsearch {
            hosts => "my-elastic.local:9200"
            index => "kubernetes-%{+YYYY.MM.dd}"
    }
  } else {
    elasticsearch {
            hosts => "my-elastic.local:9200"
            index => "logstash-%{+YYYY.MM.dd}"
    }
  }
}

```

Any ideas, why this is not working? Unfortunately it's using the "else" output (= index =\> "logstash-%{+YYYY.MM.dd}")

Strangely enough, I see that field "kubernetes.namespace" in Kibana...

Logstash version: 6.3.0

Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 27, 2018, 2:56pm UTC](https://discuss.elastic.co/t/logstash-output-if-field-exists-use-other-index/141958/2 "2018-07-27T14:56:26Z")

</div>

That should probably be

```
if [kubernetes][namespace] {
```

---

<div class="post-metadata">

**Author:** ![johann](https://avatars.discourse-cdn.com/v4/letter/j/54ee81/32.png) [@johann](https://discuss.elastic.co/u/johann)\
**Post date:** [July 27, 2018, 3:03pm UTC](https://discuss.elastic.co/t/logstash-output-if-field-exists-use-other-index/141958/3 "2018-07-27T15:03:25Z")

</div>

that easy... thank you, problem solved! 😊

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2018, 3:03pm UTC](https://discuss.elastic.co/t/logstash-output-if-field-exists-use-other-index/141958/4 "2018-08-24T15:03:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.