# Seperate filebeats for different groups of servers

**URL:** https://discuss.elastic.co/t/seperate-filebeats-for-different-groups-of-servers/242908
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 28, 2020, 12:37pm UTC](https://discuss.elastic.co/t/seperate-filebeats-for-different-groups-of-servers/242908 "2020-07-28T12:37:20Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 28, 2020, 8:23pm UTC](https://discuss.elastic.co/t/seperate-filebeats-for-different-groups-of-servers/242908/4 "2020-07-28T20:23:29Z")

</div>

you can have logstash in between. You can have more control on your data if you have logstash in between.

Of course, you can change index names coming from filebeat especially if you have logstash.

- Just tag the dataset in filebeat (inputs.d) or fields (eg. .. my\_db\_oracle)
- in Logstash, just do the logic based on tag or fields and redirect to relevant index (eg: [index on condition](https://discuss.elastic.co/t/logstash-filter-fields-in-if-conditions/242717/2))

---

_[View the full topic](https://discuss.elastic.co/t/seperate-filebeats-for-different-groups-of-servers/242908)._