# Not able to create indexes using multiple logs files in filebeat tags
**URL:** https://discuss.elastic.co/t/not-able-to-create-indexes-using-multiple-logs-files-in-filebeat-tags/270328
**Category:** Beats
**Tags:** filebeat
**Created:** [April 16, 2021, 6:08am UTC](https://discuss.elastic.co/t/not-able-to-create-indexes-using-multiple-logs-files-in-filebeat-tags/270328 "2021-04-16T06:08:57Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@balaji\_pal](https://discuss.elastic.co/u/balaji_pal)
#### Post date: [April 16, 2021, 6:08am UTC](https://discuss.elastic.co/t/not-able-to-create-indexes-using-multiple-logs-files-in-filebeat-tags/270328/1 "2021-04-16T06:08:57Z")
Hi Guys,
I'm not able to create custom indexes in elastic search using logstash and filebeat.
Log flow (Filebeat ==\> logstash ==\> elasticsearch)
I have two custom logs files such as /var/log/app1/app1.log and /var/log/app2/app2.log.
In Filebeat I want to pass these log files along with tags, so each log file has its own tags i.e (app1 and app2).
Using these tags, I want to filter it out using logstash, so it can create two custom indexes in elastic search (app1\_logs and app2\_logs).
Below is my config file, please suggest to me if any changes are required.
* * *
filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- type: log
enabled: true
paths:
* * *
demo-logstash.conf
input {
beats {
type =\> "log"
port =\> 5044
host =\> "0.0.0.0"
}
}
output {
if [fields][tags] == "app1" {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "app1\_logs"
}
}
if [fields][tags] == "app2" {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "app2\_logs"
}
}
stdout { codec =\> rubydebug }
}
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [April 16, 2021, 12:35pm UTC](https://discuss.elastic.co/t/not-able-to-create-indexes-using-multiple-logs-files-in-filebeat-tags/270328/2 "2021-04-16T12:35:05Z")
It's because the tags key is an array. Try using index 0 of the array for the if statement or use a field that isn't an array
---
### Author:  [@balaji\_pal](https://discuss.elastic.co/u/balaji_pal)
#### Post date: [April 16, 2021, 4:29pm UTC](https://discuss.elastic.co/t/not-able-to-create-indexes-using-multiple-logs-files-in-filebeat-tags/270328/3 "2021-04-16T16:29:36Z")
Hi @legoguy1000 ,
I have tried the below one, but not able to create indexes.
Can you please share an example?
if [fields][tags][0] == "app1" {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "app1\_logs"
}
}
if [fields][tags][0] == "app2" {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "app2\_logs"
}
}
---
### Author:  [@balaji\_pal](https://discuss.elastic.co/u/balaji_pal)
#### Post date: [April 19, 2021, 4:51am UTC](https://discuss.elastic.co/t/not-able-to-create-indexes-using-multiple-logs-files-in-filebeat-tags/270328/4 "2021-04-19T04:51:31Z")
Hi @legoguy1000 ,
The problem has been solved !!!
Instead of using log type in filebeat I have used filestream type and it's start working for me.
Before:
filebeat.yml
- type: log
enabled: true
paths:
/var/log/app1/app1.log
fields:
tags: ["app1"]
After:
filebeat.yml
- type: filestream
enabled: true
paths:
/var/log/app1/app1.log
fields:
tags: ["app1"]
demo-logstash.conf
output {
if [fields][tags][0] == "app1" {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "app1\_logs"
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2021, 6:51am UTC](https://discuss.elastic.co/t/not-able-to-create-indexes-using-multiple-logs-files-in-filebeat-tags/270328/5 "2021-05-17T06:51:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.