# Sending data to to different Elasticsearch instances from Logstash
**URL:** https://discuss.elastic.co/t/sending-data-to-to-different-elasticsearch-instances-from-logstash/232830
**Category:** Logstash
**Created:** [May 15, 2020, 1:28pm UTC](https://discuss.elastic.co/t/sending-data-to-to-different-elasticsearch-instances-from-logstash/232830 "2020-05-15T13:28:21Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)
#### Post date: [May 15, 2020, 1:28pm UTC](https://discuss.elastic.co/t/sending-data-to-to-different-elasticsearch-instances-from-logstash/232830/1 "2020-05-15T13:28:21Z")
I'm looking to send data to two different Elasticsearch instances. If pretty sure that each one of these options will work but many months ago I had a similar setup in a different environment and the way I had implemented the split created some odd issues with the data in each environment. I don't remember all of the details so I figured I'd just post this here and double-check.
Along with sending data to two ES instances, I would like to send metricbeat data from a specific host to the second ES instance. Is one of the options below better than the other? Nested IF vs two different IF's? If it even makes a difference.
```auto
Option 1, nested IF statement:
output {
if [agent][type] == "metricbeat" {
elasticsearch {
hosts => ["https://abc.gov:9243"]
manage_template => false
index => "metricbeat-%{[agent][version]}"
user => logstash_internal
password => Pleasework18_li
ssl => true
cacert => "/etc/logstash/cert.pem"
index => "metricbeat-%{[agent][version]}"
ilm_rollover_alias => "metricbeat-%{[agent][version]}"
ilm_pattern => "000001"
ilm_policy => "metricbeat-%{[agent][version]}"
}
if [agent][type] == "metricbeat" and [host][hostname] =~ "(host1|host2|host3)" {
elasticsearch {
hosts => ["https://def.gov:9243"]
manage_template => false
index => "metricbeat-%{[agent][version]}"
user => logstash_internal
password => Pleasework18_li
ssl => true
cacert => "/etc/logstash/cert.pem"
index => "metricbeat-%{[agent][version]}"
}
}
}
```
```auto
Option 2, two different IF statements:
output {
if [agent][type] == "metricbeat" {
elasticsearch {
hosts => ["https://abc.gov:9243"]
manage_template => false
index => "metricbeat-%{[agent][version]}"
user => logstash_internal
password => Pleasework18_li
ssl => true
cacert => "/etc/logstash/cert.pem"
index => "metricbeat-%{[agent][version]}"
ilm_rollover_alias => "metricbeat-%{[agent][version]}"
ilm_pattern => "000001"
ilm_policy => "metricbeat-%{[agent][version]}"
}
}
if [agent][type] == "metricbeat" and [host][hostname] =~ "(host1|host2|host3)" {
elasticsearch {
hosts => ["https://def.gov:9243"]
manage_template => false
index => "metricbeat-%{[agent][version]}"
user => logstash_internal
password => Pleasework18_li
ssl => true
cacert => "/etc/logstash/certt.pem"
index => "metricbeat-%{[agent][version]}"
}
}
}
```
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [May 15, 2020, 1:40pm UTC](https://discuss.elastic.co/t/sending-data-to-to-different-elasticsearch-instances-from-logstash/232830/2 "2020-05-15T13:40:51Z")
i would think that in both config, events will get written to both indices when ` {[host][hostname] =~ "(host1|host2|host3)` . this is because both conditions are evaluated as true.
if i follow your intention, i would go with
```
output {
if [agent][type] == "metricbeat" {
if [host][hostname] =~ "(host1|host2|host3)" {
[es1]
}
else {
[es2]
}
}
}
```
---
### Author:  [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)
#### Post date: [May 15, 2020, 1:45pm UTC](https://discuss.elastic.co/t/sending-data-to-to-different-elasticsearch-instances-from-logstash/232830/3 "2020-05-15T13:45:41Z")
Appreciate the quick response. I seem to have missed the fact that I do want the events to go to both ES instances, sorry about that. With your recommendation though I now see how I would split the data to one and not the other if needed.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2020, 1:45pm UTC](https://discuss.elastic.co/t/sending-data-to-to-different-elasticsearch-instances-from-logstash/232830/4 "2020-06-12T13:45:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.