# Winlogbeat Can create diiferent indices

**URL:** <https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [March 12, 2019, 9:10am UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895 "2019-03-12T09:10:54Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dv\_Thiyanesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dv_thiyanesh/32/53965_2.png) [@Dv\_Thiyanesh](https://discuss.elastic.co/u/Dv_Thiyanesh)\
**Post date:** [March 12, 2019, 9:10am UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/1 "2019-03-12T09:10:54Z")

</div>

instead of having Winlogbeat create daily indices We can create separate index for logs from different client(Different machine) to one elasticsearch server

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 13, 2019, 1:41pm UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/2 "2019-03-13T13:41:42Z")

</div>

I guess you are looking for [`output.elasticsearch.index`](https://www.elastic.co/guide/en/beats/winlogbeat/current/elasticsearch-output.html#index-option-es) or [`output.elasticsearch.indices`](https://www.elastic.co/guide/en/beats/winlogbeat/current/elasticsearch-output.html#indices-option-es) settings. The docs show how this can be done.

---

<div class="post-metadata">

**Author:** ![Dv\_Thiyanesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dv_thiyanesh/32/53965_2.png) [@Dv\_Thiyanesh](https://discuss.elastic.co/u/Dv_Thiyanesh)\
**Post date:** [March 13, 2019, 2:04pm UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/3 "2019-03-13T14:04:27Z")

</div>

yah I think so...I am sending logs to logstash using winlogbeat and then to elasticsearch

Where i want to change this settings?  
in logstash config file?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 13, 2019, 2:19pm UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/4 "2019-03-13T14:19:15Z")

</div>

These are setting in the elasticsearch output in winlogbeat. If you send to logstash, then you can not use those settings. You will have to do filtering/routin in logstash. Check out `index` setting in logstash elasticsearch output

---

<div class="post-metadata">

**Author:** ![Dv\_Thiyanesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dv_thiyanesh/32/53965_2.png) [@Dv\_Thiyanesh](https://discuss.elastic.co/u/Dv_Thiyanesh)\
**Post date:** [March 13, 2019, 2:23pm UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/5 "2019-03-13T14:23:56Z")

</div>

But There is no these kind of settings in logstash index?

What can i do?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 14, 2019, 1:12pm UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/6 "2019-03-14T13:12:42Z")

</div>

See [`index` setting](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index). You can reuse any field available in your event or in `@metadata` (fields in @metadata will not be send to Elasticsearch).

---

<div class="post-metadata">

**Author:** ![Dv\_Thiyanesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dv_thiyanesh/32/53965_2.png) [@Dv\_Thiyanesh](https://discuss.elastic.co/u/Dv_Thiyanesh)\
**Post date:** [March 14, 2019, 5:33pm UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/7 "2019-03-14T17:33:42Z")

</div>

> [@steffens](#):
>
> You can reuse any field available in your event

What I cannot get it? could you explain little bit?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 15, 2019, 2:10pm UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/8 "2019-03-15T14:10:45Z")

</div>

In Logstash you can configure the index to be:

```auto
output {
  elasticsearch {
    ...
    index => "%{[@metadata][index]}-%{+yyyy.MM.dd}"
  }
}

```

In this example the `@metadata.index` field will be used as base name. Using conditionals in filter, you can set this field to whatever you need.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2019, 2:10pm UTC](https://discuss.elastic.co/t/winlogbeat-can-create-diiferent-indices/171895/9 "2019-04-12T14:10:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.