# Show different Index for different fields

**URL:** https://discuss.elastic.co/t/show-different-index-for-different-fields/214116
**Category:** Kibana
**Created:** [January 7, 2020, 7:19pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116 "2020-01-07T19:19:02Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [January 7, 2020, 7:19pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116/1 "2020-01-07T19:19:03Z")

</div>

I have a field called fields.log\_type which has three values- access, errors, dispatch. I want each value to be its own index on discover tab. Is it possible?

```auto
Time message fields.log_type
Jan 7, 2020 @ 11:11:33.281 <incidentid>24749056</incidentid> access
Jan 7, 2020 @ 11:11:33.139 Workflow.InIsDispatchPaused = true dispatch

```

---

<div class="post-metadata">

### Author: ![cheiligers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheiligers/32/73114_2.png) [@cheiligers](https://discuss.elastic.co/u/cheiligers)
#### Post date: [January 7, 2020, 8:13pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116/2 "2020-01-07T20:13:08Z")

</div>

@Mehak_Bhargava Thank you for your question. I'm not sure I understand exactly what you mean by `each value to be its own index`. Do you want each value (access, errors and dispatch) to be individual index patterns or do you want these to be columns in the Discover table?  
If neither of these matches what you want, could you maybe provide an annotated screen shot of your desired result?  
Thanks!

---

<div class="post-metadata">

### Author: ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [January 7, 2020, 8:25pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116/3 "2020-01-07T20:25:17Z")

</div>

@cheiligers, thanks for responding! Sorry for the confusing statement but what I mean is that as shown below in screenshot, I want IncidentLogErrorIndex label to be created and then all values with field.log\_type=errors shows up. And Hence make three such filters that separate out the results.  
Right now I have to make it repeatedly since these are filters only. And when filter is for access logs, i have to delete the errors filter. So just it in a way where i click this custom label and required output is shown, similar to how fields function.

 ![kibanaindex](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9f56b5c4dc064533cadaf8ddd6705043c7790bd4.png)

---

<div class="post-metadata">

### Author: ![cheiligers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheiligers/32/73114_2.png) [@cheiligers](https://discuss.elastic.co/u/cheiligers)
#### Post date: [January 7, 2020, 9:22pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116/4 "2020-01-07T21:22:11Z")

</div>

@Mehak_Bhargava, I think I understand now, thank you for the screen shot and the extra information. I'm not sure if you are aware of the extra options that filters give you. For example, you could create three filters, one for each of the different values of `fields.log_type`. To only have one of them active, you can temporarily disable the other two by clicking on the filter pills and selecting the `Temporarily disable` option. There are other options for filter pills too: [https://www.elastic.co/guide/en/kibana/current/field-filter.html#filter-pinning](https://www.elastic.co/guide/en/kibana/current/field-filter.html#filter-pinning).

---

<div class="post-metadata">

### Author: ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [January 7, 2020, 9:29pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116/5 "2020-01-07T21:29:48Z")

</div>

@cheiligers, just applied that and it works.  
But is there a better way to separate the logs result based on fields.log\_type? I have been trying to make multiple index and even have a discussion page going on it but haven't been successful at it so thought this way of using filters, if not replicate but help with the purpose of multiple index.

> [@All files collected under on index only. Is it possible to have multiple indexes for multiple files?](https://discuss.elastic.co/t/all-files-collected-under-on-index-only-is-it-possible-to-have-multiple-indexes-for-multiple-files/212806):
>
> EVery time I search GET cat/index? in kibana, I only get one index under all files are collected. I want to get three indexes for three different log files given in filebeat. This is logstash.conf file input { beats { port =\> 5044 } } filter { if[log\_type] =="access"{ grok { match =\> {"message" =\> "%{COMBINEDAPACHELOG}"} } else if [log\_type] == "errors" { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } }else [log\_type] == "dispatcher"…

---

<div class="post-metadata">

### Author: ![cheiligers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheiligers/32/73114_2.png) [@cheiligers](https://discuss.elastic.co/u/cheiligers)
#### Post date: [January 8, 2020, 3:26pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116/6 "2020-01-08T15:26:35Z")

</div>

@Mehak_Bhargava I would also have suggested dividing the index pattern up using Logstash and hopefully that will work eventually!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 5, 2020, 3:26pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116/7 "2020-02-05T15:26:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
