# Multiple index in elasticsearch from filebeat
**URL:** https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154
**Category:** Beats
**Tags:** filebeat
**Created:** [July 6, 2017, 6:10pm UTC](https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154 "2017-07-06T18:10:26Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)
#### Post date: [July 6, 2017, 6:10pm UTC](https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154/1 "2017-07-06T18:10:27Z")
Hi , I want to create a two outputs filters in logstash , that depends on the "type" field sent from filebeat:
```
filebeat:
prospectors:
-
paths:
- /var/log/app.log
input_type: log
document_type: app
paths:
- /var/log/stuff.log
input_type: log
document_type: stuff
```
I have in logstash two filterss:
filterapp.conf
```
filter {
if[type] == "app" {
.......
}
```
filterfoo.conf
```
filter {
if[type] == "stuff " {
.......
}
```
output.conf
```
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
```
I would like to create 2 outputs with 2 indexes
app-\*
stuff-\*
How Can I tell to output {} to send the logs to app index or stuff index?
---
### Author:  [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)
#### Post date: [July 6, 2017, 7:21pm UTC](https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154/2 "2017-07-06T19:21:04Z")
I dont know if this is the correct way , but it seems to be working:
output {
if [type] == "git" {
elasticsearch {
hosts =\> ["localhost:9200"]
sniffing =\> true
manage\_template =\> false
index =\> "stash-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
else
{
elasticsearch {
hosts =\> ["localhost:9200"]
sniffing =\> true
manage\_template =\> false
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 6, 2017, 10:32pm UTC](https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154/3 "2017-07-06T22:32:56Z")
That is the best way 🙂
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [July 7, 2017, 2:26pm UTC](https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154/4 "2017-07-07T14:26:05Z")
yeah, seems to work.
You can use the `mutate` filter to overwrite `@metadata.type` with another value in the filter section. Like:
```auto
filter {
if [type] == "git" {
mutate ...
}
}
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
```
Using `@metadata` in logstash is for 'private' use in your script. You can set/remove any fields at will. Logstash will remove `@metadata` when serializing the event to JSON.
Instead of overwriting '@metadata.beat', you can also create `@metadata.index` in the filter and use `index => "{[@metadata][index]}"`.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 4, 2017, 2:26pm UTC](https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154/5 "2017-08-04T14:26:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.