# Send to multiple elasticsearch index with different fields

**URL:** https://discuss.elastic.co/t/send-to-multiple-elasticsearch-index-with-different-fields/97208
**Category:** Logstash
**Created:** [August 16, 2017, 8:35am UTC](https://discuss.elastic.co/t/send-to-multiple-elasticsearch-index-with-different-fields/97208 "2017-08-16T08:35:59Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [August 16, 2017, 8:35am UTC](https://discuss.elastic.co/t/send-to-multiple-elasticsearch-index-with-different-fields/97208/1 "2017-08-16T08:35:59Z")

</div>

I have log like this:

{  
"info":"just for search",  
"url":"123.234.123.234:8080/abc",  
"response": {  
"code": 200,  
"status": ok,  
"cmd": "login"  
}  
}

and I want to send the total log into index A for text search, and send only the code/status/cmd to another index B for aggregation。

so， how to do this?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 16, 2017, 9:25am UTC](https://discuss.elastic.co/t/send-to-multiple-elasticsearch-index-with-different-fields/97208/2 "2017-08-16T09:25:27Z")

</div>

You need to use a clone filter to split each event in two. Then use different filters on each copy of the message and send them to different outputs.

---

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [August 16, 2017, 9:33am UTC](https://discuss.elastic.co/t/send-to-multiple-elasticsearch-index-with-different-fields/97208/3 "2017-08-16T09:33:19Z")

</div>

what is clone filter? means two filter in one config file?

---

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [August 16, 2017, 9:35am UTC](https://discuss.elastic.co/t/send-to-multiple-elasticsearch-index-with-different-fields/97208/4 "2017-08-16T09:35:24Z")

</div>

Ok, I have already know what is clone . Thank you !

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 13, 2017, 9:36am UTC](https://discuss.elastic.co/t/send-to-multiple-elasticsearch-index-with-different-fields/97208/5 "2017-09-13T09:36:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
