# Set indices based on (sub) module name
**URL:** https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850
**Category:** Beats
**Tags:** filebeat
**Created:** [February 10, 2022, 2:00pm UTC](https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850 "2022-02-10T14:00:25Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@tartaarsap](https://discuss.elastic.co/u/tartaarsap)
#### Post date: [February 10, 2022, 2:00pm UTC](https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850/1 "2022-02-10T14:00:25Z")
I'm trying to send my log files into multiple indices based on a sub (module) value. With the code below it works for the main module.
```auto
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]
indices:
- index: "ModuleA-%{+yyyy.MM.dd}"
when.equals:
event.module: "Module"
```
However, in the structure I use, there are (sub) modules? I am not sure how to call them or how to use them to sent them to an index.:
```auto
C:\ELK\filebeat-7.11.1-windows-x86_64\module\Module
C:\ELK\filebeat-7.11.1-windows-x86_64\module\Module\A
C:\ELK\filebeat-7.11.1-windows-x86_64\module\Module\B
C:\ELK\filebeat-7.11.1-windows-x86_64\module\Module\C
C:\ELK\filebeat-7.11.1-windows-x86_64\module\Module\D
```
I would like a separate index for A, B, C and D.
How can I do this? I been trying for a long time but looks like I am stuck.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [February 10, 2022, 2:18pm UTC](https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850/2 "2022-02-10T14:18:22Z")
Where are the module and sub module names come from? If you have a field for the submodule name you could include it in the `when` condition.
---
### Author:  [@tartaarsap](https://discuss.elastic.co/u/tartaarsap)
#### Post date: [February 10, 2022, 3:02pm UTC](https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850/3 "2022-02-10T15:02:22Z")
I created the modules and names myself. I am trying to parse custom logging, but would like to get them into different indexes.
So in my module.d I have the following:
```auto
- module: Example
ExampleA:
enabled: true
var.paths: ["D:/example/*ExampleA*.csv"]
ExampleB:
enabled: true
var.paths: ["D:/Example/*Exampleb*.csv"]
ExampleC:
enabled: true
var.paths: ["D:/Example/ExampleC*.csv"]
ExampleD:
enabled: true
var.paths: ["D:/Example/ExampleD*.csv"]
```
This is monitoring a folder, where the logging will be dumped into and based on the filename the right module will trigger. This all works, but now all logging will show up in the index filebeat.
I would like to have the output of the submodules in a different index,.
I tried things the things below, but only the main module "example" seems to work .
```auto
when.equals:
event.module: "example.exampleA"
or
when.equals:
event.module: "example_exampleA"
or
when.equals:
event.module: "exampleA"
```
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [February 10, 2022, 5:20pm UTC](https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850/4 "2022-02-10T17:20:24Z")
You're talking about the datasets/filesets. Use `event.dataset` which is in the format of `.` like `apache.access`.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 10, 2022, 7:21pm UTC](https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850/5 "2022-03-10T19:21:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.