# Multiple Elastic Search Outputs for two different Azure event hubs as input in Logstash **URL:** \ **Category:** Logstash\ **Created:** [October 20, 2022, 2:54pm UTC](https://discuss.elastic.co/t/multiple-elastic-search-outputs-for-two-different-azure-event-hubs-as-input-in-logstash/317129 "2022-10-20T14:54:59Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Anudeep\_Konaboina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anudeep_konaboina/32/98091_2.png) [@Anudeep\_Konaboina](https://discuss.elastic.co/u/Anudeep_Konaboina)\ **Post date:** [October 20, 2022, 2:54pm UTC](https://discuss.elastic.co/t/multiple-elastic-search-outputs-for-two-different-azure-event-hubs-as-input-in-logstash/317129/1 "2022-10-20T14:54:59Z")
I have to configure log stash to read from 2 different event hubs and write them to two different Elasticsearch index as shown below: ```auto input { azure_event_hubs { config_mode => "advanced" threads => 8 decorate_events => true initial_position => "beginning" storage_connection => "" storage_container => "event-hub-logs" event_hubs => [ {"Firsteventhub" => { event_hub_connection => "***" consumer_group => "logstash" } }, {"Secondeventhub" => { event_hub_connection => "***" consumer_group => "logstash2" } } ] } } filter { json { source => "message" } } output { elasticsearch { hosts => ["host"] ssl => false ssl_certificate_verification => false user => "**" password => "***" index => "test index1" ilm_enabled => false } elasticsearch { hosts => ["host"] ssl => false ssl_certificate_verification => false user => "**" password => "***" index => "test index2" ilm_enabled => false } } ``` 1. How do I use filters to send the **firsteventhub** logs into **testindex1** and **Secondeventhub** logs to **testindex2**? 2. Also is one storage container enough or should i use different storage containers for different eventhubs? Could you please help me out here as i am stuck with this?. Thanks in advance! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 20, 2022, 3:14pm UTC](https://discuss.elastic.co/t/multiple-elastic-search-outputs-for-two-different-azure-event-hubs-as-input-in-logstash/317129/2 "2022-10-20T15:14:39Z")
> [@Anudeep\_Konaboina](#): > > How do I use filters to send the **firsteventhub** logs into **testindex1** and **Secondeventhub** logs to **testindex2**? There is an open issue requesting that add\_field be a per-event\_hub option, but it has not been implemented. Instead of using a single plugin in advanced mode, you could use two plugins in basic mode, and have them each add a unique tag to the events, then use `if "uniqueTag1" in [tags] {` to route them to different outputs. No filters needed for this functionality. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 20, 2022, 4:07pm UTC](https://discuss.elastic.co/t/multiple-elastic-search-outputs-for-two-different-azure-event-hubs-as-input-in-logstash/317129/3 "2022-10-20T16:07:40Z")
Since you are using `decorete_events => true`, you have the name of the event hub in the `@metadata` field. The name will be in the field `[@metadta][azure_event_hubs][name]` so you could use it to filter in your output. ```auto output { if [@metadta][azure_event_hubs][name] == "Firsteventhub" { elasticsearch { output for index 1 } } else if [@metadta][azure_event_hubs][name] == "Secondeventhub" { elasticsearch { output index 2 } } } ``` I do not see any issue about using the same storage container, but I prefer to use one per eventhub. ---
**Author:** ![Anudeep\_Konaboina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anudeep_konaboina/32/98091_2.png) [@Anudeep\_Konaboina](https://discuss.elastic.co/u/Anudeep_Konaboina)\ **Post date:** [October 20, 2022, 6:09pm UTC](https://discuss.elastic.co/t/multiple-elastic-search-outputs-for-two-different-azure-event-hubs-as-input-in-logstash/317129/4 "2022-10-20T18:09:49Z")
Getting the below error after making the change ```auto [2022-10-20T18:07:43,745][WARN][com.microsoft.azure.eventprocessorhost.PartitionPump][main][1400938c3650184d2dbddb078307173436a8f6aa021b8c4bf7dcc69bd618b03a] host logstash-553d9839-6f42-47b8-9096-452681992ff2: 1:Got exception from onEvents org.logstash.MissingConverterException: Missing Converter handling for full class name=org.apache.qpid.proton.amqp.Binary, simple name=Binary at org.logstash.Valuefier.fallbackConvert(Valuefier.java:118) ~[logstash-core.jar:?] at org.logstash.Valuefier.convert(Valuefier.java:96) ~[logstash-core.jar:?] at org.logstash.ConvertedMap.newFromMap(ConvertedMap.java:74) ~[logstash-core.jar:?] at org.logstash.Valuefier.lambda$initConverters$15(Valuefier.java:178) ~[logstash-core.jar:?] at org.logstash.Valuefier.convert(Valuefier.java:94) ~[logstash-core.jar:?] at org.logstash.ext.JrubyEventExtLibrary$RubyEvent.safeValueifierConvert(JrubyEventExtLibrary.java:367) ~[logstash-core.jar:?] at org.logstash.ext.JrubyEventExtLibrary$RubyEvent.ruby_set_field(JrubyEventExtLibrary.java:126) ~[logstash-core.jar:?] at org.logstash.ext.JrubyEventExtLibrary$RubyEvent$INVOKER$i$2$0$ruby_set_field.call(JrubyEventExtLibrary$RubyEvent$INVOKER$i$2$0$ruby_set_field.gen) ~[jruby.jar:?] at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:835) ~[jruby.jar:?] at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207) ~[jruby.jar:?] at home.devl.logstash_minus_8_dot_1_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_azure_event_hubs_minus_1_dot_4_dot_3.lib.logstash.inputs.processor.RUBY$block$onEvents$2(/home/devl/logstash-8.1.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-azure_event_hubs-1.4.3/lib/logstash/inputs/processor.rb:51) ~[?:?] at org.jruby.ir.targets.YieldSite.yield(YieldSite.java:112) ~[jruby.jar:?] at home.devl.logstash_minus_8_dot_1_dot_0.logstash_minus_core.lib.logstash.codecs.delegator.RUBY$block$decode$2(/home/devl/logstash-8.1.0/logstash-core/lib/logstash/codecs/delegator.rb:64) ~[?:?] at org.jruby.ir.targets.YieldSite.yield(YieldSite.java:112) ~[jruby.jar:?] at home.devl.logstash_minus_8_dot_1_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_plain_minus_3_dot_1_dot_0.lib.logstash.codecs.plain.RUBY$method$decode$0(/home/devl/logstash-8.1.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-plain-3.1.0/lib/logstash/codecs/plain.rb:54) ~[?:?] at home.devl.logstash_minus_8_dot_1_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_plain_minus_3_dot_1_dot_0.lib.logstash.codecs.plain.RUBY$method$decode$0$ __VARARGS__ (/home/devl/logstash-8.1.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-plain-3.1.0/lib/logstash/codecs/plain.rb:49) ~[?:?] at org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80) ~[jruby.jar:?] at org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70) ~[jruby.jar:?] at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:197) ~[jruby.jar:?] at home.devl.logstash_minus_8_dot_1_dot_0.logstash_minus_core.lib.logstash.codecs.delegator.RUBY$block$decode$1(/home/devl/logstash-8.1.0/logstash-core/lib/logstash/codecs/delegator.rb:62) ~[?:?] at org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138) ~[jruby.jar:?] at org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58) ~[jruby.jar:?] at org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:32) ~[jruby.jar:?] at org.jruby.runtime.Block.call(Block.java:147) ~[jruby.jar:?] at org.logstash.instrument.metrics.MetricExt.doTime(MetricExt.java:160) ~[logstash-core.jar ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 17, 2022, 6:10pm UTC](https://discuss.elastic.co/t/multiple-elastic-search-outputs-for-two-different-azure-event-hubs-as-input-in-logstash/317129/5 "2022-11-17T18:10:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.