# Migration from old ELK to Elastic Cloud **URL:** \ **Category:** Logstash\ **Created:** [February 16, 2022, 12:27pm UTC](https://discuss.elastic.co/t/migration-from-old-elk-to-elastic-cloud/297369 "2022-02-16T12:27:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![mgfeal](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Post date:** [February 16, 2022, 12:27pm UTC](https://discuss.elastic.co/t/migration-from-old-elk-to-elastic-cloud/297369/1 "2022-02-16T12:27:06Z")
Hello, We are in the process of migrating an older version of ELK to Elastic Cloud. We are already evaluating pricing, subscription model, etc. and I am getting ahead of the process with some question I have. Right now we use Filebeat to collect logs from IIS servers and send them to logstash. Each IIS has several log folders and with Filebeat we tag them using "fields" so that in logstash depending on the tag they are added to a certain index. In Elastic Cloud I think there is no logstash, do you know how to do it so that in Elastic Cloud we know what each log corresponds to? Thanks! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 16, 2022, 1:03pm UTC](https://discuss.elastic.co/t/migration-from-old-elk-to-elastic-cloud/297369/2 "2022-02-16T13:03:30Z")
You can do that in filebeat using conditionals in the output. This part of the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#indices-option-es) has the following example. ```auto output.elasticsearch: hosts: ["http://localhost:9200"] indices: - index: "warning-%{[agent.version]}-%{+yyyy.MM.dd}" when.contains: message: "WARN" - index: "error-%{[agent.version]}-%{+yyyy.MM.dd}" when.contains: message: "ERR" ``` Depending on what you do with Logstash you could also keep your Logstash server and output the data to Elastic Cloud as some things are not possible to do with just Filebeat and Elasticsearch and need Logstash. ---
**Author:** ![mgfeal](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Post date:** [February 17, 2022, 10:58am UTC](https://discuss.elastic.co/t/migration-from-old-elk-to-elastic-cloud/297369/3 "2022-02-17T10:58:22Z")
Filebeat collects the log files from several IIS servers and, depending on the folder, assigns a "field" name to each one so that logstash marks an index name for it. But from what you say, we can substitute this code, which is the one we use right now on some servers: ```auto #=========================== Filebeat prospectors ============================= filebeat.inputs: #IIS 01 - type: filestream paths: - \\p......1\logfiles\Workbench\W3SVC1\*.log - \\p......2\logfiles\Workbench\W3SVC1\*.log - \\p......3\logfiles\Workbench\W3SVC1\*.log - \\p......4\logfiles\Workbench\W3SVC1\*.log fields: our_service_name: "iis-prod-01" #ignore_older: 8h exclude_lines: ["^#"] exclude_files: [".zip$"] multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}' multiline.negate: true multiline.match: after #IIS 02 - type: filestream paths: - \\p......1\logfiles\ServicesRoot\W3SVC2\*.log - \\p......2\logfiles\ServicesRoot\W3SVC2\*.log - \\p......3\logfiles\ServicesRoot\W3SVC2\*.log - \\p......4\logfiles\ServicesRoot\W3SVC2\*.log fields: our_service_name: "iis-prod-02" #ignore_older: 8h exclude_lines: ["^#"] exclude_files: [".zip$"] multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}' multiline.negate: true multiline.match: after #----------------------------- Logstash output -------------------------------- output.logstash: enabled: true # Puerto 5044/tcp para PROD, 5045/tcp para preprod hosts: ["x.x.x.x:5044"] #output.console: # pretty: true ``` And replace "field" with "indices", so we wouldn't need logstash. ```auto #=========================== Filebeat prospectors ============================= filebeat.inputs: #IIS 01 - type: filestream paths: - \\p......1\logfiles\Workbench\W3SVC1\*.log - \\p......2\logfiles\Workbench\W3SVC1\*.log - \\p......3\logfiles\Workbench\W3SVC1\*.log - \\p......4\logfiles\Workbench\W3SVC1\*.log #ignore_older: 8h exclude_lines: ["^#"] exclude_files: [".zip$"] multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}' multiline.negate: true multiline.match: after indices: - index: "iis-prod-01-%{+yyyy.MM.dd}" #IIS 02 - type: filestream paths: - \\p......1\logfiles\ServicesRoot\W3SVC2\*.log - \\p......2\logfiles\ServicesRoot\W3SVC2\*.log - \\p......3\logfiles\ServicesRoot\W3SVC2\*.log - \\p......4\logfiles\ServicesRoot\W3SVC2\*.log #ignore_older: 8h exclude_lines: ["^#"] exclude_files: [".zip$"] multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}' multiline.negate: true multiline.match: after indices: - index: "iis-prod-02-%{+yyyy.MM.dd}" #----------------------------- Logstash output -------------------------------- output.logstash: enabled: true # Puerto 5044/tcp para PROD, 5045/tcp para preprod hosts: ["x.x.x.x:5044"] #output.console: # pretty: true ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 17, 2022, 1:38pm UTC](https://discuss.elastic.co/t/migration-from-old-elk-to-elastic-cloud/297369/4 "2022-02-17T13:38:55Z")
That's not what was said and it is not what is described in the documentation. The `indices` is an option of the `elasticsearch` output, not an option for the inputs. What it is in the documentation is that you can conditionally change the index of the Elasticsearch output using the `indices` option. The example clearly show this: ```auto output.elasticsearch: hosts: ["http://localhost:9200"] indices: - index: "warning-%{[agent.version]}-%{+yyyy.MM.dd}" when.contains: message: "WARN" - index: "error-%{[agent.version]}-%{+yyyy.MM.dd}" when.contains: message: "ERR" ``` It is using the value of the `message` field to change which will be the destination index. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 17, 2022, 1:39pm UTC](https://discuss.elastic.co/t/migration-from-old-elk-to-elastic-cloud/297369/5 "2022-03-17T13:39:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.