Saving logs in different logstash index

Elastic Stack Logstash
3

i think you should be use type field (like document_typ in filebeat config) and config for logstash will be look like

filter{
	if [type] == "type1" {
		grok{
			match => ["message","pattern1"]
		}
	}
	if [type] == "type2" {
		grok{
			match => ["message","pattern2"]
		}
	}
	
}

output {
	if [type] == "type1" {
		elasticsearch {
			hosts: ["http://localhost:9200"]
  			index: "index1-%{+yyyy.MM.dd}"
		}
	}
	if [type] == "type2" {
		elasticsearch {
			hosts: ["http://localhost:9200"]
  			index: "index2-%{+yyyy.MM.dd}"
		}
	}
}

Or maybe you can read https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#_literal_indices_literal in update for ES 6.0

I prefer routing data in logstash :smiley: