# Send to different indices with filebeat modules and ILM enabled

**URL:** <https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 28, 2021, 1:43pm UTC](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507 "2021-01-28T13:43:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nber](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nber/32/81992_2.png) [@nber](https://discuss.elastic.co/u/nber)\
**Post date:** [January 28, 2021, 1:43pm UTC](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507/1 "2021-01-28T13:43:36Z")

</div>

Hey there,

I'd like to collect logs on a device with different modules and send them to different indices.  
The question itself is answered in:

> [@Filebeat Apache Module Change Index Name](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/2):
>
> Hi @Ryne_Keel, If you want to use different indexes for different modules you can use the [indices](https://www.elastic.co/guide/en/beats/filebeat/7.0/elasticsearch-output.html#indices-option-es) output setting. It allows you to configure different indices depending on some condition, for example you could do something like this in your case to have a different index for apache module: output.elasticsearch: hosts: ["elastic1:9200", "elastic2:9200"] indices: - index: "filebeat-%{[agent.version]}-apache-%{+yyyy.MM.dd}" when.equals: event.module: "apache" - default: …

Though, as far as I understand, this only works when ILM is disabled. Yet, I would like to keep ILM enabled on filebeat, to have the possibility to apply changes to the default index without touching/updating every device.  
Now let's say I want syslog module logs in syslog index and nginx logs in ILM default index, e.g. filebeat-XYZ.

This is no problem for self defined inputs, yet, I can't figure out how to send logs collected by modules to different indices with ILM enabled.

Thanks and best regards,  
Niklas

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2021, 3:43pm UTC](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507/2 "2021-02-25T15:43:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.