# Not able to create multiple index through logstash 7.3
**URL:** https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754
**Category:** Logstash
**Created:** [September 17, 2019, 4:32am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754 "2019-09-17T04:32:03Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@manjeetsingh](https://discuss.elastic.co/u/manjeetsingh)
#### Post date: [September 17, 2019, 4:32am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/1 "2019-09-17T04:32:03Z")
Hi Team,
I have a setup of dockerized elk setup of version 7.3.1 (Elasticsearch, logstash, Kibana, Filebeat).
ELK is running on docker only. I have installed filebeat package on same machine and provide input to logstash.
I have multiple log file like messages, auth.log, cron.log etc. and all these have configured in filebeat.yml with fields parameter for identification.
fields:
service: auth\_logs
I want to all these logs file will go logstash as input beat and output will different index as per file name in elk.
How can I achieve this ? Please help.
Version: 7.3.1
below is the logstash config file
input {
beats {
port =\> 5044
}
}
output {
elasticsearch {
hosts =\> hostip
index =\> "%{[field][service]-%{+YYYY.MM.dd}"
}
}
---
### Author:  [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)
#### Post date: [September 17, 2019, 6:45am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/2 "2019-09-17T06:45:30Z")
Hi @manjeetsingh,
You can specify the fields in filebeats and then apply the condition in logstash output plugin to create different index as specify the fields.
**Below is the example for your reference:**
Fields log\_type: access specify in the filebeat:
```
filebeat:
prospectors:
- paths:
- /path/to/logs/access.log
fields: {log_type: access}
```
Apply condition in logstash o/p plugin:
```
output {
if [fields][log_type] == "access" {
elasticsearch {
hosts => hostip
index => "%{[field][service]-%{+YYYY.MM.dd}"
}
}
if [fields][log_type] == "access_1" {
elasticsearch {
hosts => hostip
index => "index_1"
}
}
}
```
Regards,
Harsh Bajaj
---
### Author:  [@manjeetsingh](https://discuss.elastic.co/u/manjeetsingh)
#### Post date: [September 17, 2019, 7:51am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/3 "2019-09-17T07:51:33Z")
Hi Harsh Bajaj,
I have done changes as per your reply but index is not creating. Below is the config of filebeat
filebeat.inputs:
- type: log
- paths:
- /var/log/auth.log
fields:
log\_type: auth
- paths:
- /var/log/syslog
fields:
log\_type: system
Logstash:
input {
beats {
port =\> 5044
}
}
output {
if [fields][log\_type] == "auth" {
elasticsearch {
hosts =\> hostip
index =\> "%{[field][log\_type]-%{+YYYY.MM.dd}"
}
}
if [fields][log\_type] == "system" {
elasticsearch {
hosts =\> hostip
index =\> "%{[field][log\_type]-%{+YYYY.MM.dd}"
}
}
}
After that i have restarted services but no index is creating.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 17, 2019, 8:06am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/4 "2019-09-17T08:06:19Z")
Your index name patterns states ‘field’ and not ‘fields’.
---
### Author:  [@manjeetsingh](https://discuss.elastic.co/u/manjeetsingh)
#### Post date: [September 17, 2019, 8:15am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/5 "2019-09-17T08:15:47Z")
Thanks for correction but only one index is created i.e, system-index not the other (auth-index). I am getting request on other log file as well.
So how will it be achieve ?
I want to create separate index for log files for multiple instances.
---
### Author:  [@manjeetsingh](https://discuss.elastic.co/u/manjeetsingh)
#### Post date: [September 17, 2019, 9:12am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/6 "2019-09-17T09:12:42Z")
Can somebody tell me how to create separate index for log files using filebeat and logstash. I have tried above approach but didn't work.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 18, 2019, 5:14am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/7 "2019-09-18T05:14:18Z")
Look at your data in the Kibana Discover app. Do records have the correct additional field set from Filebeat? Do you see both types of documents? Is it possible that Filebeat is not correctly configured?
---
### Author:  [@manjeetsingh](https://discuss.elastic.co/u/manjeetsingh)
#### Post date: [September 18, 2019, 6:24am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/8 "2019-09-18T06:24:26Z")
I have checked kibana and field.log\_type is system which is correct for path /var/log/syslog but other field which has path /var/log/auth.log is not coming in kibana at all. Only one document is present i.e, system.
filebeat.inputs:
- type: log
- paths:
- /var/log/auth.log
fields:
log\_type: auth
- paths:
- /var/log/syslog
fields:
log\_type: system
output.logstash:
hosts: ["logstship:5044"]
Please let me know what am i doing wrong.
---
### Author:  [@manjeetsingh](https://discuss.elastic.co/u/manjeetsingh)
#### Post date: [September 19, 2019, 8:38am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/9 "2019-09-19T08:38:33Z")
How can I create different file per client in logstash for input beat ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 17, 2019, 8:38am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-index-through-logstash-7-3/199754/10 "2019-10-17T08:38:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.