# Unable to create dynamic index with conditional check in logstash

**URL:** <https://discuss.elastic.co/t/unable-to-create-dynamic-index-with-conditional-check-in-logstash/148981>\
**Category:** Logstash\
**Created:** [September 18, 2018, 12:38pm UTC](https://discuss.elastic.co/t/unable-to-create-dynamic-index-with-conditional-check-in-logstash/148981 "2018-09-18T12:38:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anra137](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@anra137](https://discuss.elastic.co/u/anra137)\
**Post date:** [September 18, 2018, 12:39pm UTC](https://discuss.elastic.co/t/unable-to-create-dynamic-index-with-conditional-check-in-logstash/148981/1 "2018-09-18T12:39:00Z")

</div>

Hi,

I want to dynamically create index based on the events. I have configured configured several log files in filebeat and the events are successfully stored in ElasticSearch. But when I try to differentiate the logs in different index, it is only passing one of the condition in logstash. For example:

```
filter {
    grok {
        match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} *\[%{GREEDYDATA:logger}\] \(%{WORD:thread}\) %{GREEDYDATA:message}"}
        match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} *\[%{JAVACLASS:logger}\] \(%{GREEDYDATA:thread}\) \{%{GREEDYDATA:mdc}\} %{GREEDYDATA:message}"}
        }
    if "test" in [tags]{
       mutate { replace => { "[@metadata][type]" => "test" } }
    }
}
output {
if "_grokparsefailure" not in [tags] {
    elasticsearch {
    hosts => ["localhost:9200"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][type]}-%{+YYYY.MM.dd}"
    }

  }
}

```

Filebeat config:  
type: log  
enabled: true  
paths:  
- C:\work\programs\agents\log\easyfile.log  
fields:  
service.id: 77877674  
tags: [delivery]  
fields\_under\_root: true  
type: log  
enabled: true  
paths:  
- C:\temp\easyfile.log  
fields:  
service.id: 12341234  
tags: [test]  
fields\_under\_root: true

For the above config, I can see one index `filebeat-test-2018.09.18` created. But not the other one which should be `filebeat-doc-2018.09.18` and got error as below

`[2018-09-18T14:27:06,598][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=&gt;400, :action=&gt;["index", {:_id=&gt;nil, :_index=&gt;"filebeat-doc-2018.09.18", :_type=&gt;"doc", :_routing=&gt;nil}, #&lt;LogStash::Event:0x361230bb&gt;], :response=&gt;{"index"=&gt;{"_index"=&gt;"filebeat-doc-2018.09.18", "_type"=&gt;"doc", "_id"=&gt;"UPSl7GUBxx--wOCZ_1LN", "status"=&gt;400, "error"=&gt;{"type"=&gt;"illegal_argument_exception", "reason"=&gt;"mapper [tags] of different type, current_type [long], merged_type [text]"}}}}`

```
The two log formats are same. Only difference is just one additional content

```

for example  
`2018-03-09 16:12:20,315 INFO [com.sample.teste.TestClass] (https-express.sample.com-433-8) Testing logger`  
`2018-03-09 16:12:20,315 INFO [com.sample.teste.TestClass] (https-express.sample.com-433-8) {my-name-1=my-value-1, my-name-2=my-value-2} Testing logger`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2018, 5:28pm UTC](https://discuss.elastic.co/t/unable-to-create-dynamic-index-with-conditional-check-in-logstash/148981/2 "2018-09-20T17:28:36Z")

</div>

For some reason the `tags` field in the filebeat-doc-2018.09.18 index has been mapped with the long type which isn't compatible with what Logstash sends. Why is that? Have you indexed documents previously with an integer `tags` field?

---

<div class="post-metadata">

**Author:** ![anra137](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@anra137](https://discuss.elastic.co/u/anra137)\
**Post date:** [September 21, 2018, 8:21am UTC](https://discuss.elastic.co/t/unable-to-create-dynamic-index-with-conditional-check-in-logstash/148981/3 "2018-09-21T08:21:03Z")

</div>

No, `tags` field was text before and the previous documents were mapped correctly. This happens only when I try to send to 2 different index based on the conditions applied. When I add the index one by one. This issue is resolved. Otherwise always only the first condition executed successfully.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2018, 8:21am UTC](https://discuss.elastic.co/t/unable-to-create-dynamic-index-with-conditional-check-in-logstash/148981/4 "2018-10-19T08:21:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.