# Saving logs in different logstash index

**URL:** https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131
**Category:** Logstash
**Created:** [December 4, 2017, 11:56am UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131 "2017-12-04T11:56:08Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Sumit\_Sijaria](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)
#### Post date: [December 4, 2017, 11:56am UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131/1 "2017-12-04T11:56:08Z")

</div>

Hi team,

I have question regarding saving logs in different logstash files based on pattern matching.

for example-

filter{  
grok{  
match =\> [  
"message","pattern1",  
"message","pattern2"  
]  
}  
}

output{  
//how to save output in different index files based on pattern match

if pattern1 matc, logs should be save to index 1  
if pattern2 match, logs should be saved to index 2 and so on

}

please note that I have logs available in same dir for apache logs, application logs and few other logs.

Thanks in advance

---

<div class="post-metadata">

### Author: ![Sumit\_Sijaria](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)
#### Post date: [December 5, 2017, 3:36am UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131/2 "2017-12-05T03:36:55Z")

</div>

Can someone please guide.

---

<div class="post-metadata">

### Author: ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)
#### Post date: [December 5, 2017, 8:33am UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131/3 "2017-12-05T08:33:58Z")

</div>

i think you should be use **type** field (like document\_typ in filebeat config) and config for logstash will be look like

```
filter{
	if [type] == "type1" {
		grok{
			match => ["message","pattern1"]
		}
	}
	if [type] == "type2" {
		grok{
			match => ["message","pattern2"]
		}
	}
	
}

output {
	if [type] == "type1" {
		elasticsearch {
			hosts: ["http://localhost:9200"]
  			index: "index1-%{+yyyy.MM.dd}"
		}
	}
	if [type] == "type2" {
		elasticsearch {
			hosts: ["http://localhost:9200"]
  			index: "index2-%{+yyyy.MM.dd}"
		}
	}
}

```

Or maybe you can read [https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#\_literal\_indices\_literal](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#_literal_indices_literal) in update for ES 6.0

I prefer routing data in logstash 😃

---

<div class="post-metadata">

### Author: ![Sumit\_Sijaria](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)
#### Post date: [December 6, 2017, 7:30am UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131/4 "2017-12-06T07:30:46Z")

</div>

Thank you

---

<div class="post-metadata">

### Author: ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)
#### Post date: [December 12, 2017, 12:04pm UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131/5 "2017-12-12T12:04:04Z")

</div>

@Sumit_Sijaria. i updated some config if you are using version 6.0  
In version 6.0, document\_type will be remove in beat config. So you can change you config in beat follow guide  
[https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#fields-under-root](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#fields-under-root)

It look like :

```auto
filebeat.prospectors:
 - type: log
 paths:
    - /var/log/apache/httpd-*.log
 fields_under_root: true
 fields:
    type: type_1

```

Instead of :

```auto
filebeat.prospectors:
 - type: log
 paths:
    - /var/log/apache/httpd-*.log
 document_type: type_1

```

Of course, logstash config not change.

---

<div class="post-metadata">

### Author: ![Sumit\_Sijaria](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)
#### Post date: [December 12, 2017, 12:34pm UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131/6 "2017-12-12T12:34:02Z")

</div>

@tatdat Thanks for heads up. I am still using older version. I am just working on POC and getting hands dirty with ELK and GROK. 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 9, 2018, 12:34pm UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131/7 "2018-01-09T12:34:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.