# Send logs to different index if grok parse fails **URL:** \ **Category:** Logstash\ **Created:** [February 8, 2017, 9:53am UTC](https://discuss.elastic.co/t/send-logs-to-different-index-if-grok-parse-fails/74353 "2017-02-08T09:53:38Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![froto](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@froto](https://discuss.elastic.co/u/froto)\ **Post date:** [February 8, 2017, 9:53am UTC](https://discuss.elastic.co/t/send-logs-to-different-index-if-grok-parse-fails/74353/1 "2017-02-08T09:53:38Z")
Hey there, at the moment i have the following problem: Many different devices are sending logs to port 514 and we dont want to reconifure all of these devices I want to make a logstash configuration which extract informations out of some devices and send the other logs to a different index like rawdata-\* How do i have to configure the output for something like this? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 8, 2017, 10:36am UTC](https://discuss.elastic.co/t/send-logs-to-different-index-if-grok-parse-fails/74353/2 "2017-02-08T10:36:00Z")
This should be very close to what you want: [http://stackoverflow.com/a/27147688/414355](http://stackoverflow.com/a/27147688/414355) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 8, 2017, 10:36am UTC](https://discuss.elastic.co/t/send-logs-to-different-index-if-grok-parse-fails/74353/3 "2017-03-08T10:36:00Z")
Closed on March 8, 2017, 10:36am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.