# Multiple metricbeat modules each with different output index

**URL:** <https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [September 7, 2017, 6:46pm UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757 "2017-09-07T18:46:08Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![jruzicka](https://avatars.discourse-cdn.com/v4/letter/j/9fc348/32.png) [@jruzicka](https://discuss.elastic.co/u/jruzicka)\
**Post date:** [September 7, 2017, 6:46pm UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757/1 "2017-09-07T18:46:08Z")

</div>

Is it possible to have different modules within a single metricbeat send to different output index location?

Like this in theory:

-module1  
metricset  
output index1

-module2  
metricset  
output index2

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [September 8, 2017, 12:14pm UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757/2 "2017-09-08T12:14:52Z")

</div>

Do you mean elasticseach index? you can use format strings in the Elasticsearch index setting. But then you are responsible for applying the mapping template yourself.

See [index setting docs](https://www.elastic.co/guide/en/beats/metricbeat/current/elasticsearch-output.html#_index).

One can do something like:

```auto
metricbeat.modules:
- module: ...
  fields.index: "module1"

outut.elasticsearch:
  ...
  index: "%{fields.index}-%{+yyyy.MM.dd}"

```

---

<div class="post-metadata">

**Author:** ![jruzicka](https://avatars.discourse-cdn.com/v4/letter/j/9fc348/32.png) [@jruzicka](https://discuss.elastic.co/u/jruzicka)\
**Post date:** [September 8, 2017, 1:05pm UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757/3 "2017-09-08T13:05:46Z")

</div>

Thank you... However, I'm not sure that answers it exactly. Can you have one module/metricset going to one index, and another module/metricset to a different index in a single metricbeat?

For example:

-module: docker  
metricsets:

- memory
- cpu  
hosts: ["unix:///var/run/docker.sock"]  
enabled: true  
period: 15s

output.elasticsearch: hosts: ["localhost:9200"]  
index: "docker-%[+yyyy.MM.dd]"

-module: system  
metricsets: ["process"]  
processes: ['.\*']

output.elasticsearch: hosts: ["localhost:9200"]  
index: "system-%[+yyyy.MM.dd]"

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [September 8, 2017, 8:06pm UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757/4 "2017-09-08T20:06:03Z")

</div>

you can have only one elasticsearch output.

The syntax is `%{...}`, not `%[...]`.

you can reference any fieldname `%{[...]}`. If want to set the index name to be the module name you can just use:

```auto
metricbeat.modules:
- module: system
  metricsets: ["process"]
  ...

- module: docker
  metricsets: ...
  ...

output.elasticsearch:
  index: '%{[metricset.module]}-%{+yyyy.MM.dd}'

```

---

<div class="post-metadata">

**Author:** ![jruzicka](https://avatars.discourse-cdn.com/v4/letter/j/9fc348/32.png) [@jruzicka](https://discuss.elastic.co/u/jruzicka)\
**Post date:** [September 8, 2017, 8:33pm UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757/5 "2017-09-08T20:33:25Z")

</div>

Great, looks like that will create two separate indexes which is my goal. Thank you!

---

<div class="post-metadata">

**Author:** ![jruzicka](https://avatars.discourse-cdn.com/v4/letter/j/9fc348/32.png) [@jruzicka](https://discuss.elastic.co/u/jruzicka)\
**Post date:** [September 27, 2017, 3:52pm UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757/6 "2017-09-27T15:52:33Z")

</div>

Is there documentation on the fieldname variables one can use in the yml output? I am looking to do something similar with filebeats for different prospectors sent to their own index.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 4, 2017, 11:23am UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757/7 "2017-10-04T11:23:51Z")

</div>

The [beats docs](https://www.elastic.co/guide/index.html) do contain a section with all fields names being published by default. Using the `fields` settings users can add additional fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2017, 11:23am UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757/8 "2017-11-01T11:23:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.