# \[Solved\] Logstash sends logs to the same elasticsearch index even after I configured not to do so
**URL:** https://discuss.elastic.co/t/solved-logstash-sends-logs-to-the-same-elasticsearch-index-even-after-i-configured-not-to-do-so/129574
**Category:** Logstash
**Created:** [April 26, 2018, 2:10am UTC](https://discuss.elastic.co/t/solved-logstash-sends-logs-to-the-same-elasticsearch-index-even-after-i-configured-not-to-do-so/129574 "2018-04-26T02:10:56Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@JohnHuElastic](https://discuss.elastic.co/u/JohnHuElastic)
#### Post date: [April 26, 2018, 2:10am UTC](https://discuss.elastic.co/t/solved-logstash-sends-logs-to-the-same-elasticsearch-index-even-after-i-configured-not-to-do-so/129574/1 "2018-04-26T02:10:56Z")
I got two logs, one is nginx access log, another is gunicorn access log.
The two logs has similar contents, but I want them to be two different elasticsearch indices.
Here are my conf files:
```auto
# /etc/logstash/conf.d/nginx-access-01.conf
input {
file {
path => "/home/deploy/log/fresh/nginx_access.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
grok {
match => { "message" => "%{DATA:log_host} %{IPORHOST:remote_ip} -%{DATA:remote_user}- \[%{HTTPDATE:timestamp}\] \"%{WORD:request_method} %{DATA:request_path} HTTP/%{NUMBER:http_version}\" %{NUMBER:response_code} %{NUMBER:response_length} \"%{DATA:request_referer}\" \"%{DATA:user_agent}\""}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "nginx-access-%{+YYYY.MM.dd}"
}
}
```
```auto
# /etc/logstash/conf.d/gunicorn-access-01.conf
input {
file {
path => "/home/deploy/log/fresh/gunicorn_access.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
grok {
match => { "message" => "%{DATA:log_host} %{IPORHOST:remote_ip} -%{DATA:remote_user}- \[%{HTTPDATE:timestamp}\] \"%{WORD:request_method} %{DATA:request_path} HTTP/%{NUMBER:http_version}\" %{NUMBER:response_code} %{NUMBER:response_length} \"%{DATA:request_referer}\" \"%{DATA:user_agent}\""}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "gunicorn-access-%{+YYYY.MM.dd}"
}
}
```
There are mainly two differences in these two conf files: the input file path and the output elasticsearch index.
I think these are enough for logstash to send different logs to different elasticsearch indices.
But when I check elasticsearch, the two logs is mixed up with each other, some logs in nginx access log file are found in gunicorn-access-\* index and some gunicorn nginx.
So what is wrong with my config files?
---
### Author:  [@NerdSec](https://discuss.elastic.co/u/NerdSec)
#### Post date: [April 26, 2018, 4:24am UTC](https://discuss.elastic.co/t/solved-logstash-sends-logs-to-the-same-elasticsearch-index-even-after-i-configured-not-to-do-so/129574/2 "2018-04-26T04:24:22Z")
Hi John,
You need to explicitly specify Logstash to use those two conf files as separate entities. By default, both the files will work in a piped configuration. That means, logstash will treat them as a single configuration.
You can either use conditionals or Multiple Pipeline configuration in Logstash to parse as two seperate indices.
[https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html)
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)
> **[Introducing Multiple Pipelines in Logstash
| Elastic](https://www.elastic.co/blog/logstash-multiple-pipelines)**
>
> Being a central component of data flow between producers and consumers, it often happens that a single Logstash is responsible for driving multiple parallel streams of events. The existence of t...
Hope this helps.
---
### Author:  [@JohnHuElastic](https://discuss.elastic.co/u/JohnHuElastic)
#### Post date: [April 26, 2018, 6:17am UTC](https://discuss.elastic.co/t/solved-logstash-sends-logs-to-the-same-elasticsearch-index-even-after-i-configured-not-to-do-so/129574/3 "2018-04-26T06:17:49Z")
Thank you @NerdSec, the multiple-pipelines solution works !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 24, 2018, 6:17am UTC](https://discuss.elastic.co/t/solved-logstash-sends-logs-to-the-same-elasticsearch-index-even-after-i-configured-not-to-do-so/129574/4 "2018-05-24T06:17:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.