# Sending output to different indices depending on conditions

**URL:** <https://discuss.elastic.co/t/sending-output-to-different-indices-depending-on-conditions/343423>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 20, 2023, 7:31am UTC](https://discuss.elastic.co/t/sending-output-to-different-indices-depending-on-conditions/343423 "2023-09-20T07:31:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DetlefG](https://avatars.discourse-cdn.com/v4/letter/d/da6949/32.png) [@DetlefG](https://discuss.elastic.co/u/DetlefG)\
**Post date:** [September 20, 2023, 7:31am UTC](https://discuss.elastic.co/t/sending-output-to-different-indices-depending-on-conditions/343423/1 "2023-09-20T07:31:17Z")

</div>

Hi,  
I try to write logs via filebeat to different indices depending on a field in the logs. But I'm not sure, how the rule setting **when** is working.  
Is it correct, that if the first **when** condition is fullfilled the second and further will not be checked ?

For better explanation - the goal is to write to different indices depending on the field **kubernetes.namespace**. If the field **kubernetes.namespace** contains **test** then the log should be written to index **k8s-%{[kubernetes.namespace]}-%{[loglevel]}** otherwise to **k8s-%{[kubernetes.namespace]}**.

Does the following configuration work as described above or will logs be written to both indices - **k8s-%{[kubernetes.namespace]}-%{[loglevel]}** and **k8s-%{[kubernetes.namespace]}** - if **namespace** is containing **test**?

```auto
output.elasticsearch:
  hosts: ['${ELASTICSEARCH_HOSTS}']
  index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"
  indices:
    - index: "k8s-%{[kubernetes.namespace]}-%{[loglevel]}"
      when.regexp:
        kubernetes.namespace: "test"
    - index: "k8s-%{[kubernetes.namespace]}"
      when.regexp:     
        kubernetes.namespace: ".*"

```

Thnx for any help !

Best regards, Detlef

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2023, 9:31am UTC](https://discuss.elastic.co/t/sending-output-to-different-indices-depending-on-conditions/343423/2 "2023-10-18T09:31:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.