# Multiple Paths for different Indexes

**URL:** <https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 16, 2016, 5:33am UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511 "2016-03-16T05:33:45Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [March 16, 2016, 5:33am UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511/1 "2016-03-16T05:33:45Z")

</div>

Can I configure multiple log path for multiple indexes. At present I have indexes named as IISLogs and ServiceLogs. I am using FB -\> ES -\> KB.

Is it possible to configure C:\My IIS LOGS\_.log -\> IISLOGS and C:\My Service LOGS\_.log -\> ServiceLogs. If Yes, where can I do this ?

---

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [March 16, 2016, 11:24pm UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511/2 "2016-03-16T23:24:13Z")

</div>

Any update on this ?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 18, 2016, 8:35am UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511/3 "2016-03-18T08:35:48Z")

</div>

In filebeat it is not possible to send data to multiple indices when sent directly to elasticsearch. When sending to Logstash first, Logstash can split up your log files and send them to different indices. Best is to use in filebeat 2 different prospectors for the log files and set a different document\_type or field, so this can be used in Logstash to do the logic.

---

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [March 24, 2016, 9:20pm UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511/4 "2016-03-24T21:20:53Z")

</div>

How can I have multiple indexes in the output field ? Can I add IF and ELSE checks ?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 27, 2016, 6:42pm UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511/5 "2016-03-27T18:42:04Z")

</div>

That is not possible with filebeat. You can do this kind of transformations with Logstash.

---

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [March 27, 2016, 7:11pm UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511/6 "2016-03-27T19:11:39Z")

</div>

Yes i am asking for logstash configuration only....

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 27, 2016, 7:14pm UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511/7 "2016-03-27T19:14:01Z")

</div>

For if statements it is best to have a look at the LS docs here: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511/8 "2017-07-05T21:54:08Z")

</div>


