# Multiple Elasticsearch types output for a same log

**URL:** <https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547>\
**Category:** Logstash\
**Created:** [May 9, 2016, 12:38pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547 "2016-05-09T12:38:04Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![LetMeR00t](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LetMeR00t](https://discuss.elastic.co/u/LetMeR00t)\
**Post date:** [May 9, 2016, 12:38pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/1 "2016-05-09T12:38:05Z")

</div>

Hello everyone,

I'm working on a project using ELK and I would like to know if it's possible for Logstash to store information of a same document but in different Elasticsearch types ?

Because my explanation is not very clear, I give you the following example that I have in mind :

Imagine a log : {timestamp: X, toto:1, titi:2}  
I would like to know if it's possible for Logstash when it's receiving this log to do :

- Store timestamp and 1 in Elasticsearch type "toto"
- Store timestamp and 2 in Elasticsearch type "titi"  
in the same time ...

Of course, it could have more types than 2.

I hope to be clear enough

Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2016, 7:15am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/2 "2016-05-10T07:15:47Z")

</div>

Where are you defining the types?

---

<div class="post-metadata">

**Author:** ![LetMeR00t](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LetMeR00t](https://discuss.elastic.co/u/LetMeR00t)\
**Post date:** [May 10, 2016, 7:44am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/3 "2016-05-10T07:44:21Z")

</div>

Well, for me I define only one type that I use in output and I build it in filters...  
But it seems to me that we can't put data into multiple types ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2016, 9:47am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/4 "2016-05-10T09:47:55Z")

</div>

Sure you can, but why?

```auto
output {
 elasticsearch {
    hosts => ["host:9220"]
    index => INDEX
    document_type => TYPE1
  }
 elasticsearch {
    hosts => ["host:9220"]
    index => INDEX
    document_type => TYPE2
  }
}

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2016, 10:44am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/5 "2016-05-10T10:44:56Z")

</div>

If I understand you correctly, you want to split an event like

```
{"timestamp": "X", "toto": 1, "titi:" 2}

```

into two events,

```
{"timestamp": "X", "toto": 1}

```

and

```
{"timestamp": "X", "titi:" 2}

```

and send each event to a separate index? If yes, use a clone filter to clone the original event and use other filters to modify each copy as desired.

---

<div class="post-metadata">

**Author:** ![LetMeR00t](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LetMeR00t](https://discuss.elastic.co/u/LetMeR00t)\
**Post date:** [May 10, 2016, 11:33am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/6 "2016-05-10T11:33:02Z")

</div>

This is what I want to do but imagine now that I have multiple types according to some fields that I can identify, is there a kind of loop that I can do depending on the number of types I identify in the message ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2016, 12:21pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/7 "2016-05-10T12:21:51Z")

</div>

The Logstash configuration language doesn't support loops. You might need to use a ruby filter.

---

<div class="post-metadata">

**Author:** ![LetMeR00t](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LetMeR00t](https://discuss.elastic.co/u/LetMeR00t)\
**Post date:** [May 10, 2016, 1:09pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/8 "2016-05-10T13:09:12Z")

</div>

Ok, that is what I was thinking.  
Well, I will reconsider my template to see if I can do things in an other way 🙂

Thank you for your replies

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-types-output-for-a-same-log/49547/9 "2017-07-06T04:58:18Z")

</div>