# Output to different kafka topic

**URL:** <https://discuss.elastic.co/t/output-to-different-kafka-topic/203465>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 14, 2019, 1:26pm UTC](https://discuss.elastic.co/t/output-to-different-kafka-topic/203465 "2019-10-14T13:26:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fabien\_Morel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fabien_morel/32/49396_2.png) [@Fabien\_Morel](https://discuss.elastic.co/u/Fabien_Morel)\
**Post date:** [October 14, 2019, 1:26pm UTC](https://discuss.elastic.co/t/output-to-different-kafka-topic/203465/1 "2019-10-14T13:26:34Z")

</div>

Hi !  
I'm using filebeat 7.4.0 to send linux logs to kafka.  
I want to split the data from one file into 2 topics. For example data from /var/log/secure should go to topic1 if it contains "sudo" and topic2 if not.

My problem is that the "and" condition seems not working.  
Here is what I tried :

As input

> ```
> - type: log
> enabled: true
> paths:
> - /var/log/secure
> fields:
> kafka_topic: "system"
> test: "test"
> 
> ```

As output

> topic: "default"  
> topics:  
> - topic : "system"  
> when.and:  
> - equals:  
> fields.test: test  
> - equals:  
> field.kafka\_topic: system

but filebeat display me :  
**Exiting: error initializing publisher: missing or invalid condition**

I've tried several things, removing the "-", split the "when" and "and", but nothing work !  
I know the condition is stupid here, but i've try each separatly and they work.

Do you have a working example for the "and" condition on kafka output ?  
Regards,  
Fabien

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2019, 1:26pm UTC](https://discuss.elastic.co/t/output-to-different-kafka-topic/203465/2 "2019-11-11T13:26:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.