# Multiple logs to a single index

**URL:** <https://discuss.elastic.co/t/multiple-logs-to-a-single-index/358891>\
**Category:** Elasticsearch\
**Created:** [May 7, 2024, 5:07am UTC](https://discuss.elastic.co/t/multiple-logs-to-a-single-index/358891 "2024-05-07T05:07:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![k13045](https://avatars.discourse-cdn.com/v4/letter/k/ccd318/32.png) [@k13045](https://discuss.elastic.co/u/k13045)\
**Post date:** [May 7, 2024, 5:07am UTC](https://discuss.elastic.co/t/multiple-logs-to-a-single-index/358891/1 "2024-05-07T05:07:18Z")

</div>

Hello,

I have a use case to fetch the log messages from Kafka audit cluster and send it to Elastic. But the log messages each are of different format and if I send the messages to respective index I'm ending up with creating multiple indexes which will later become tedious to manage.

Can I send them all to a single index? What's the best way to implement it?

Regards,  
Nagendra

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [May 27, 2024, 3:19pm UTC](https://discuss.elastic.co/t/multiple-logs-to-a-single-index/358891/2 "2024-05-27T15:19:18Z")

</div>

> [@k13045](#):
>
> Hello,
> 
> I have a use case to fetch the log messages from Kafka audit cluster and send it to Elastic. But the log messages each are of different format and if I send the messages to respective index I'm ending up with creating multiple indexes which will later become tedious to manage.
> 
> Can I send them all to a single index? What's the best way to implement it?
> 
> Regards,  
> Nagendra

Hello Nagendra,

Yes, you can send all log messages to a single index. You can use Logstash or Filebeat to consume messages from Kafka and send them to Elasticsearch. To handle different log formats, you can use Elasticsearch ingest pipelines or Logstash filters for processing and normalizing data before indexing.

Best regards
