# More indexes in Filebeat
**URL:** https://discuss.elastic.co/t/more-indexes-in-filebeat/141348
**Category:** Kibana
**Created:** [July 24, 2018, 9:59am UTC](https://discuss.elastic.co/t/more-indexes-in-filebeat/141348 "2018-07-24T09:59:08Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Cristian\_Tiu](https://discuss.elastic.co/u/Cristian_Tiu)
#### Post date: [July 24, 2018, 9:59am UTC](https://discuss.elastic.co/t/more-indexes-in-filebeat/141348/1 "2018-07-24T09:59:08Z")
I want to have some search statistics. I have only one log file, where i can separate the lines with a attribute.
I want to use one filebeat, one elasticsearch and more kibana.
I try to have in filebeat more indexes:
index1-\*
index2-\*
etc.
Is this possible?
---
### Author:  [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)
#### Post date: [July 24, 2018, 10:16am UTC](https://discuss.elastic.co/t/more-indexes-in-filebeat/141348/2 "2018-07-24T10:16:19Z")
Yes it's possible.
Directly at the filbeat level, not to my knowledge. But you can separate the elements according to the tags in your output.
\*\*EXAMPLE \*\*
```
output {
if "XXXX" not in [tags] {
elasticsearch {
index => "idx-%{+YYYY.MM.dd}"
host => ""
port => ""
}
} else {
elasticsearch {
index => "idx-2-%{+YYYY.MM.dd}"
host => ""
port => ""
}
}
}
```
---
### Author:  [@Cristian\_Tiu](https://discuss.elastic.co/u/Cristian_Tiu)
#### Post date: [July 24, 2018, 10:21am UTC](https://discuss.elastic.co/t/more-indexes-in-filebeat/141348/3 "2018-07-24T10:21:33Z")
Unfortunately, i don't know where should i enter this configuration.
I have the following output to elasticsearch in the filebeat.yml.
output.elasticsearch:
hosts: "localhost:9200"
index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"
pipeline: "shop-search-log"
indices:
- index: "aposalis-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
include\_lines: "aposalis"
- index: "marienbrunn-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
include\_lines: "marienbrunn"
---
### Author:  [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)
#### Post date: [July 24, 2018, 12:52pm UTC](https://discuss.elastic.co/t/more-indexes-in-filebeat/141348/4 "2018-07-24T12:52:48Z")
You have to install Logstash and specify all the beats agents that you have to send the data collected to logstash.
Then, in logstash, it has a configuration file of which there are three parts:
- Input
- filter
- output
In the input part, it will be a beat. must be specified in this conf file.
In filter, if you want to parse your collected logs.
And finally in the part, output, you have to define the output. it will be elasticsearch.
Let me know if you want an example of a typical configuration file.
---
### Author:  [@Cristian\_Tiu](https://discuss.elastic.co/u/Cristian_Tiu)
#### Post date: [July 24, 2018, 1:04pm UTC](https://discuss.elastic.co/t/more-indexes-in-filebeat/141348/5 "2018-07-24T13:04:02Z")
Ok, thank you very much.
Without Logstash is this not possible?
---
### Author:  [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)
#### Post date: [July 24, 2018, 1:12pm UTC](https://discuss.elastic.co/t/more-indexes-in-filebeat/141348/6 "2018-07-24T13:12:45Z")
yes, you can do it without logstash. but I did not know before.
I searched, I found against I have not tested but it must work
```
output.elasticsearch:
hosts: ["http://localhost:9200"]
index: "logs-%{[beat.version]}-%{+yyyy.MM.dd}"
indices:
- index: "critical-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
message: "CRITICAL"
- index: "error-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
message: "ERR"
```
Source : [https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html)
let me know, if it works well
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 21, 2018, 1:12pm UTC](https://discuss.elastic.co/t/more-indexes-in-filebeat/141348/7 "2018-08-21T13:12:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.