# Output to multiple indexes straight from filebeat.yml?

**URL:** <https://discuss.elastic.co/t/output-to-multiple-indexes-straight-from-filebeat-yml/130165>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 1, 2018, 9:15pm UTC](https://discuss.elastic.co/t/output-to-multiple-indexes-straight-from-filebeat-yml/130165 "2018-05-01T21:15:29Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 2, 2018, 3:43pm UTC](https://discuss.elastic.co/t/output-to-multiple-indexes-straight-from-filebeat-yml/130165/2 "2018-05-02T15:43:59Z")

</div>

you hardcoded the index name in your output to `index1`. It is the index setting which selects the index name to use.

See [index docs](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es) and [indices docs](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#_literal_indices_literal).

The index setting supports [Format Strings](https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format-type.html#_format_string_sprintf). That is, you can use any field in the event to construct the index.

e.g.

```auto
filebeat.prospectors:
- ...
  fields:
    type: "logs1"
- ...
  fields:
    type: "logs2"

setup.template.name: "index-%{[beat.version]}"
setup.template.pattern: "index-%{[beat.version]}-*"

output.elasticsearch:
  ...
  index: "index-%{[beat.version]}-%{[fields.type]:other}-%{+yyyy.MM.dd}"

```

Choosing a good index name requires some considerations. In my example I opted to have a common prefix + include the beat version and event acquisition date.  
Having a common prefix ensures the index template is used for both indices. Including the beat version (or some kind of versioning) ensure your setup will not break if you ever update filebeat with changed document type (e.g. 5.4 and 6.2 template mappings are not fully copmatible). The date at the end ensure you will have a daily index. Having daily indices enables you to do some index lifecycle management. E.g. move old indices to cold storage or delete very old indices (retention policies). The `index` setting will read the `fields.type` when constructing the index name. If `fields.type` is missing, the default value of `other` will be used to construct the index name.

---

_[View the full topic](https://discuss.elastic.co/t/output-to-multiple-indexes-straight-from-filebeat-yml/130165)._