# Reindex a subset of data to a different index

**URL:** <https://discuss.elastic.co/t/reindex-a-subset-of-data-to-a-different-index/237341>\
**Category:** Logstash\
**Created:** [June 16, 2020, 4:29pm UTC](https://discuss.elastic.co/t/reindex-a-subset-of-data-to-a-different-index/237341 "2020-06-16T16:29:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [June 16, 2020, 4:29pm UTC](https://discuss.elastic.co/t/reindex-a-subset-of-data-to-a-different-index/237341/1 "2020-06-16T16:29:40Z")

</div>

Hello all, we're using Elasticsearch to index Windows event logs and keeping them for 6 months; what I would like to do is reindex a subset of data such as:

- user creation/deletion events
- group creation/deletion events
- interactive user logon events

...to another index that will be kept for longer. I'd like to do this at the same time as events are going into the main Windows event log index but as far as I can tell you can't write the same data to different indexes simultaneously.

Can anyone tell me what my options are?

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 16, 2020, 4:39pm UTC](https://discuss.elastic.co/t/reindex-a-subset-of-data-to-a-different-index/237341/2 "2020-06-16T16:39:37Z")

</div>

> [@kernelpanic](#):
>
> as far as I can tell you can't write the same data to different indexes simultaneously

You can have multiple elasticsearch outputs in a single pipeline, so you can write data to different indexes simultaneously. The outputs can be surrounded with conditionals so that only a subset of data is written to one of the indexes.

---

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [June 16, 2020, 5:00pm UTC](https://discuss.elastic.co/t/reindex-a-subset-of-data-to-a-different-index/237341/3 "2020-06-16T17:00:44Z")

</div>

Thankyou Badger I wasn't aware you could have conditionals in the output, will look into it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2020, 5:00pm UTC](https://discuss.elastic.co/t/reindex-a-subset-of-data-to-a-different-index/237341/4 "2020-07-14T17:00:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.