# Sending unique filename pattern to unique Index?

**URL:** <https://discuss.elastic.co/t/sending-unique-filename-pattern-to-unique-index/85683>\
**Category:** Logstash\
**Created:** [May 14, 2017, 1:50pm UTC](https://discuss.elastic.co/t/sending-unique-filename-pattern-to-unique-index/85683 "2017-05-14T13:50:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [May 14, 2017, 1:50pm UTC](https://discuss.elastic.co/t/sending-unique-filename-pattern-to-unique-index/85683/1 "2017-05-14T13:50:44Z")

</div>

Hi,

How can I send different log files to different indexs?

For example:  
I read with the "filebeat" a file called: abc.full.log and a file called xyz.cdr and send both to LogStash. How can I make that abc.full.log will go to Index A and xyz.cdr will got to Index B.

Many thanks,  
Tomer

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 15, 2017, 5:31am UTC](https://discuss.elastic.co/t/sending-unique-filename-pattern-to-unique-index/85683/2 "2017-05-15T05:31:57Z")

</div>

That's most likely a bad idea since you don't want to have too many indexes, but to answer your question both Logstash and Filebeat populate events with the path to the file an event was read from. In the Filebeat case I think that field is `source`. You can then use e.g. a grok filter to extract the piece you want to use directly in the index name.

---

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [May 29, 2017, 6:01am UTC](https://discuss.elastic.co/t/sending-unique-filename-pattern-to-unique-index/85683/3 "2017-05-29T06:01:05Z")

</div>

Hi,

Thank you for the answer and the advise.

Regarding the advice, isn't it better to have indexs for every type of data. The reasoning behind the question is if we query the ES very frequently, wouldn't it be easier for the ES if we query a unique index? Therefor there should be unique indexs for every type of information?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 29, 2017, 6:30am UTC](https://discuss.elastic.co/t/sending-unique-filename-pattern-to-unique-index/85683/4 "2017-05-29T06:30:09Z")

</div>

> Regarding the advice, isn't it better to have indexs for every type of data. The reasoning behind the question is if we query the ES very frequently, wouldn't it be easier for the ES if we query a unique index? Therefor there should be unique indexs for every type of information?

It might be beneficial (it depends on the kind of queries you make), but it needs to be balanced against the overhead of having lots of indexes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2017, 6:30am UTC](https://discuss.elastic.co/t/sending-unique-filename-pattern-to-unique-index/85683/5 "2017-06-26T06:30:31Z")

</div>

Closed on June 26, 2017, 6:30am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.