# Wrong values pass to index

**URL:** <https://discuss.elastic.co/t/wrong-values-pass-to-index/207564>\
**Category:** Logstash\
**Created:** [November 12, 2019, 5:28pm UTC](https://discuss.elastic.co/t/wrong-values-pass-to-index/207564 "2019-11-12T17:28:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![namali](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@namali](https://discuss.elastic.co/u/namali)\
**Post date:** [November 12, 2019, 5:28pm UTC](https://discuss.elastic.co/t/wrong-values-pass-to-index/207564/1 "2019-11-12T17:28:57Z")

</div>

there are multiple config files in logstash server. all configs files transfer data to different indexes. values pass from other config files as well to particular index. Please let me know how to over come from to pass values to correct index.  
used type condition, but it didn't work .

---

<div class="post-metadata">

**Author:** ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)\
**Post date:** [November 12, 2019, 5:57pm UTC](https://discuss.elastic.co/t/wrong-values-pass-to-index/207564/2 "2019-11-12T17:57:54Z")

</div>

I would like to help, but you need to give us some more information and show us some of your configuration and what you want to achieve.

---

<div class="post-metadata">

**Author:** ![namali](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@namali](https://discuss.elastic.co/u/namali)\
**Post date:** [November 13, 2019, 5:17am UTC](https://discuss.elastic.co/t/wrong-values-pass-to-index/207564/3 "2019-11-13T05:17:55Z")

</div>

three config files in logstash

1. country.conf  
input {  
s3 {  
id =\> "act\_tmcountry"  
access\_key\_id =\> "..."  
secret\_access\_key =\> "...."  
bucket =\> "supplier"  
prefix =\> "test\_n"  
interval =\> 15  
additional\_settings =\> {  
force\_path\_style =\> true  
follow\_redirects =\> false  
}  
}  
}  
filter{  
json { source =\> "message" }  
split { field =\> "data" }  
mutate {  
add\_field =\> {  
"country\_id" =\> "%{[data][id]}"  
"vendorcountrycode" =\> "%{[data][code]}"  
"vendorcountryname" =\> "%{[data][name]}"  
}  
}  
if ("\_split\_type\_failure" not in [tags]) {  
mutate {  
remove\_field =\> ["success","data","message"]  
}  
}  
}  
output {  
elasticsearch {  
document\_id =\> "%{[country\_id]}"  
hosts =\> [" ..../"]  
index =\> "act\_tm\_country"  
}  
stdout {codec =\> rubydebug}  
}

data come in json files. all country details json in test\_n folder

2 ) city.conf  
input {  
s3 {  
id =\> "act\_tmcity"  
access\_key\_id =\> "...."  
secret\_access\_key =\> "..."  
bucket =\> "supplier"  
prefix =\> "test\_n4"  
additional\_settings =\> {  
force\_path\_style =\> true  
follow\_redirects =\> false  
}  
}  
}  
filter{  
json { source =\> "message" }  
split { field =\> "data" }  
mutate {  
add\_field =\> {  
"id" =\> "%{[data][id]}"  
"vendorcitycode" =\> "%{[data][id]}"  
"vendorcityname" =\> ""  
"country\_id" =\> "%{[data][country\_id]}"  
}  
}  
mutate {  
remove\_field =\> ["success","data","@timestamp","message"]  
}  
}  
output {  
elasticsearch {  
document\_id =\> "%{[id]}"  
hosts =\> [".../"]  
index =\> "act\_tm\_city\_test"  
}  
stdout {codec =\> rubydebug}  
}

all city detail json files in test\_n4 folder

tlist.conf

input {  
s3 {  
id =\> "act\_tmtlist"  
access\_key\_id =\> "..."  
secret\_access\_key =\> "..."  
bucket =\> "supplier"  
prefix =\> "test\_n2"  
interval =\> 15  
additional\_settings =\> {  
force\_path\_style =\> true  
follow\_redirects =\> false  
}  
}  
}  
filter{  
json { source =\> "message" }  
split { field =\> "data" }  
mutate {  
add\_field =\> {  
"tid" =\> "%{[data][id]}"  
"imagethumbnailurl" =\> "%{[data][thumbnail\_url]}"  
"vendorcitycode" =\> "%{[data][city\_id]}"  
}  
}  
if ("\_split\_type\_failure" not in [tags]) {  
mutate {  
remove\_field =\> ["success","data","message"]  
}  
}  
}  
output {  
elasticsearch {  
document\_id =\> "%{[tid]}"  
hosts =\> ["..."]  
index =\> "act\_tm\_tlist"  
}  
stdout {codec =\> rubydebug}  
}

all detail list json files in test\_n2 folder

want to push test\_n to act\_tm\_country, test\_n4 to act\_tm\_city and test\_n2 to act\_tm\_tlist.

but act\_tm\_country and act\_tm\_city indexes get objects of act\_tm\_tlist as well.  
I tried putting type in input and checking [type] condition in filter and output in all 3 config files. but didn't work it. and also put id in input section even its not working.

appreciate your help pls.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 13, 2019, 4:03pm UTC](https://discuss.elastic.co/t/wrong-values-pass-to-index/207564/4 "2019-11-13T16:03:40Z")

</div>

If you point path.config at a directory then it will concatenate all of the configuration files in that directory, read events from the inputs and send them to all of the outputs.

You could use a different pipeline for each configuration, or you could use tag events on the inputs and use conditionals based on the tags.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2019, 4:03pm UTC](https://discuss.elastic.co/t/wrong-values-pass-to-index/207564/5 "2019-12-11T16:03:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.