# Unable to create multiple index in elastic from logstash
**URL:** https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643
**Category:** Logstash
**Created:** [April 11, 2018, 1:45pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643 "2018-04-11T13:45:33Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@sauravsuman689](https://discuss.elastic.co/u/sauravsuman689)
#### Post date: [April 11, 2018, 1:45pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/1 "2018-04-11T13:45:33Z")
Hi,
I am using filebeat-\>logstash-\>elastic-\>kibana
I am unable to create multiple index in elastic . Please advise. One index is getting created but not both.
Filebeat.yml is below
* * *
filebeat.prospectors:
- type: log
paths:
- /var/lib/mesos/slave/slaves/_/frameworks/_/executors/_/runs/latest/stdout_
- /var/lib/mesos/slave/slaves/_/frameworks/_/executors/_/runs/latest/stderr_
- /var/log/mesos/\*.log
fields:
log\_type: docker-logs
- type: log
paths:
- /nfs/nfsbackup/dcos-stage2/bhw-nginx/logs/access\*
- /nfs/nfsbackup/dcos-stage2/bhw-nginx/logs/error\*
fields:
log\_type: nginx-logs
fields\_under\_root: true
exclude\_files: ["stdout.logrotate.state", "stdout.logrotate.conf", "stderr.logrotate.state", "stderr.logrotate.conf"]
tail\_files: true
output.logstash:
hosts:
- "192.168.2.136:5044"
password: changeme
username: logstash\_system
logstash.conf file under pipeline is below -
input {
```
beats {
port => "5044"
}
```
}
filter {
if [log\_type] == "nginx-logs" {
grok {
match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}
}
}
else if [log\_type] == "docker-logs" {
grok {
match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}
}
}
}
output {
if [log\_type] == "nginx-logs" {
elasticsearch {
hosts =\> ["192.168.2.191:9201","192.168.2.138:9201","192.168.2.195:9201"]
user =\> "elastic"
password =\> "changeme"
index =\> "web-%{+YYYY.MM.dd}"
}
}
else if [log\_type] == "docker-logs" {
elasticsearch {
hosts =\> ["192.168.2.191:9201","192.168.2.138:9201","192.168.2.195:9201"]
user =\> "elastic"
password =\> "changeme"
index =\> "app-%{+YYYY.MM.dd}"
}
}
}
I can only see web index got created but not the app index. I tried all the ways but no gain.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 11, 2018, 2:04pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/2 "2018-04-11T14:04:28Z")
It looks like you have defined the logstash output under the nginx prospector. You should reduce the level of indentation of it so that output.logstash is at the same level as filebeat.prospectors
---
### Author:  [@sauravsuman689](https://discuss.elastic.co/u/sauravsuman689)
#### Post date: [April 11, 2018, 3:08pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/3 "2018-04-11T15:08:08Z")
Hi Badger,
logstash out is under the filebeat.prospectors only. It's just the copy past on the blog which shows it like that. I also validated the filebeat.yml in yml validator online.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 11, 2018, 3:24pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/4 "2018-04-11T15:24:49Z")
The I would enabled debug logging in filebeat.yml. It will tell you which files it is checking, which ones it actually starts prospectors for, and every time it notices a change in a file.
---
### Author:  [@sauravsuman689](https://discuss.elastic.co/u/sauravsuman689)
#### Post date: [April 11, 2018, 3:57pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/5 "2018-04-11T15:57:09Z")
Hi Badger,
I enabled debug mode in filebeat.yml file and I see it is pushing both the log\_types which I have mentioned in the yml file from it's location.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 11, 2018, 4:09pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/6 "2018-04-11T16:09:05Z")
You have fields\_under\_root for one but not the other. Either add that or change the test to be
```auto
else if [fields][log_type] == "docker-logs" {
```
---
### Author:  [@sauravsuman689](https://discuss.elastic.co/u/sauravsuman689)
#### Post date: [April 11, 2018, 4:40pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/7 "2018-04-11T16:40:01Z")
Hi Badger,
Thanks a lot for the help. It worked and the two indexes got created.
But it's very strange. If you see my filebeat.yml screenshot , I have mentioned fields for both the log type , but it's working for only one of them. Any idea about this. Is there any other way to mention the type under fields section.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 11, 2018, 4:58pm UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/8 "2018-04-11T16:58:14Z")
For docker-logs you have
```auto
fields:
log_type: docker-logs
```
whereas for nginx-logs you have
```auto
fields:
log_type: nginx-logs
fields_under_root: true
```
The former results in
```auto
"fields": {
"log_type": "docker-logs"
}.
```
whereas the latter results in just
```auto
"log_type": "nginx-logs"
```
---
### Author:  [@sauravsuman689](https://discuss.elastic.co/u/sauravsuman689)
#### Post date: [April 12, 2018, 2:32am UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/9 "2018-04-12T02:32:06Z")
Thank you so much for debugging and explanation..!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2018, 2:32am UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643/10 "2018-05-10T02:32:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.