# Send filebeat logs through logstash to different indexes

**URL:** <https://discuss.elastic.co/t/send-filebeat-logs-through-logstash-to-different-indexes/214753>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 13, 2020, 4:05am UTC](https://discuss.elastic.co/t/send-filebeat-logs-through-logstash-to-different-indexes/214753 "2020-01-13T04:05:13Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Immac](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@Immac](https://discuss.elastic.co/u/Immac)\
**Post date:** [January 13, 2020, 4:05am UTC](https://discuss.elastic.co/t/send-filebeat-logs-through-logstash-to-different-indexes/214753/1 "2020-01-13T04:05:13Z")

</div>

Hi Folks,

Besides the standard modules( system, auditd etc), I have to send a custom logs from one server to elasticsearch.

I am thinking of sending the logs to logstash first so that I can do some grok processing for this custom logs

How can I differentiate the logs( by adding tags etc) so that default modules log go to one index whereas other logs go to different indexes

Looking for some guidance.

Thanks in advance

Immac

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [January 13, 2020, 7:20pm UTC](https://discuss.elastic.co/t/send-filebeat-logs-through-logstash-to-different-indexes/214753/2 "2020-01-13T19:20:11Z")

</div>

Hi @Immac, welcome to the Elastic community forums!

If you simply want to distinguish logs collected by Filebeat modules vs. logs collected by a custom input, you won't need to add any special tags. This is because all log events generated by Filebeat modules will contain an `event.module` field whereas the log events generated by your custom input won't (unless you do some explicit extra configuration to add such a field, of course).

Given this, you can simply test for the existence of this `event.module` field in your Logstash pipeline like so:

```auto
  if [event][module] {
    # process log events generated by modules
  } else {
    # process log events generated by custom input 
  }

```

Hope that helps,

Shaunak

---

<div class="post-metadata">

**Author:** ![Immac](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@Immac](https://discuss.elastic.co/u/Immac)\
**Post date:** [January 14, 2020, 1:20am UTC](https://discuss.elastic.co/t/send-filebeat-logs-through-logstash-to-different-indexes/214753/3 "2020-01-14T01:20:34Z")

</div>

Hi Shaunak,

Thanks for your reply.

Let me try that and see how it goes

Cheers !!

Immac

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [January 14, 2020, 1:51am UTC](https://discuss.elastic.co/t/send-filebeat-logs-through-logstash-to-different-indexes/214753/4 "2020-01-14T01:51:33Z")

</div>

You can also use [add fields](https://www.elastic.co/guide/en/beats/filebeat/current/add-fields.html) and similar logic.

---

<div class="post-metadata">

**Author:** ![Immac](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@Immac](https://discuss.elastic.co/u/Immac)\
**Post date:** [January 14, 2020, 5:47pm UTC](https://discuss.elastic.co/t/send-filebeat-logs-through-logstash-to-different-indexes/214753/5 "2020-01-14T17:47:21Z")

</div>

Thanks guys.

I was able to use the 'tags'. Both 'event.module' and 'adding fields' should work as well.

To test I was using a static log file on the filebeat and that threw me off. Since the file did not change I was not seeing it on the logstash. For subsequent test I just renamed the file and it worked

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2020, 5:47pm UTC](https://discuss.elastic.co/t/send-filebeat-logs-through-logstash-to-different-indexes/214753/6 "2020-02-11T17:47:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.