# Split up indices based on? tags?

**URL:** <https://discuss.elastic.co/t/split-up-indices-based-on-tags/104667>\
**Category:** Logstash\
**Created:** [October 20, 2017, 7:56am UTC](https://discuss.elastic.co/t/split-up-indices-based-on-tags/104667 "2017-10-20T07:56:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maekee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maekee/32/21708_2.png) [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Post date:** [October 20, 2017, 7:56am UTC](https://discuss.elastic.co/t/split-up-indices-based-on-tags/104667/1 "2017-10-20T07:56:49Z")

</div>

Hello fellow logstash peeps,  
At the moment i am using winlogbeat agents to collect logs/documents to Logstash which sends it to ElasticSearch.

My logstash config looks like this:  
input {  
beats {  
port =\> 5044  
type =\> "log"  
}  
}

filter{ .... }

output {  
elasticsearch {  
hosts =\> "elasticsearchIP:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

Now i would like to create separated indices based on data so i can remove indices based on type and timestamp.

Now i want to gather logs from a new windows server with winlogbeat, but want the events to be created inside a new index type. And i guess in the future split up the documents into different index types.

I do tag data based on eventlog and specific servers, but the data is still inside the same winlogbeat-yyyy-MM-dd indices. And its harder to remove certain type of data then.

I also use Kibana and define index pattern, today i use winlogbeat-\*.  
So maybe the new index should be called winlogbeat-logtypeX-yyyy-MM-dd so i still see all events in the same index pattern, but different indices are created in elasticsearch.

If i am on the right track, is it ok to crate an if statement based on tag (from filter) inside the output in logstash and send index names based on that?

Help needed how to Think

Thanks

---

<div class="post-metadata">

**Author:** ![Maekee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maekee/32/21708_2.png) [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Post date:** [October 20, 2017, 11:43am UTC](https://discuss.elastic.co/t/split-up-indices-based-on-tags/104667/2 "2017-10-20T11:43:31Z")

</div>

This seems to work, which also makes sure my Kibana index parttern winlogbeat-\* still works

```
output {
  if "radius" in [tags] {
    elasticsearch {
      hosts => "elasticsearchIP:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-radius-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  } else {
    elasticsearch {
      hosts => "elasticsearchIP:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  }
}

```

How do you other guys separate indices?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2017, 11:43am UTC](https://discuss.elastic.co/t/split-up-indices-based-on-tags/104667/3 "2017-11-17T11:43:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.