# 3 différents data- set to 3 différents input-Graylog to 3 differnets ES index with différent préfix

**URL:** <https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [June 18, 2018, 10:01am UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635 "2018-06-18T10:01:22Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![keaoner](https://avatars.discourse-cdn.com/v4/letter/k/5f9b8f/32.png) [@keaoner](https://community.graylog.org/u/keaoner)\
**Post date:** [June 18, 2018, 10:01am UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/1 "2018-06-18T10:01:22Z")

</div>

Hi

Is it possible to have 3 indexes elasticsearch (3 perfixe name) for 3 Graylog input (3 different data sets) So I have:

3 Csv datasets:

```
1 - logs
2 - words
3 - queries

```

I do a processing of these 3 datasets with 3 different graylog input (amqp gelf).

I would like to know if it is possible to store since Graylog the result of each process in 3 indexes elasticsearch having a different name? eg: using prefixes

Best regards

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 18, 2018, 10:39am UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/2 "2018-06-18T10:39:22Z")

</div>

> [@keaoner](#):
>
> Is it possible to have 3 indexes elasticsearch (3 perfixe name) for 3 Graylog input (3 different data sets)

Yes, that’s possible with index sets:  
[http://docs.graylog.org/en/2.4/pages/configuration/index\_model.html](http://docs.graylog.org/en/2.4/pages/configuration/index_model.html)

---

<div class="post-metadata">

**Author:** ![keaoner](https://avatars.discourse-cdn.com/v4/letter/k/5f9b8f/32.png) [@keaoner](https://community.graylog.org/u/keaoner)\
**Post date:** [June 18, 2018, 11:58am UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/3 "2018-06-18T11:58:39Z")

</div>

It’s good newz for me Jochen, thx U  
Can I export this configuration to a content pack? to redeploy the set automatically

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 18, 2018, 12:26pm UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/4 "2018-06-18T12:26:50Z")

</div>

> [@keaoner](#):
>
> Can I export this configuration to a content pack?

No, that’s not possible.

---

<div class="post-metadata">

**Author:** ![keaoner](https://avatars.discourse-cdn.com/v4/letter/k/5f9b8f/32.png) [@keaoner](https://community.graylog.org/u/keaoner)\
**Post date:** [June 18, 2018, 1:45pm UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/5 "2018-06-18T13:45:24Z")

</div>

Really pity ☹ sniff !!!  
is it possible to push this configuration with the graylog API?

thx U

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 18, 2018, 2:01pm UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/6 "2018-06-18T14:01:03Z")

</div>

> [@keaoner](#):
>
> is it possible to push this configuration with the graylog API?

Yes, you can create index sets, inputs, streams, stream rules, processing pipelines, and pipeline rules via the Graylog REST API.

---

<div class="post-metadata">

**Author:** ![keaoner](https://avatars.discourse-cdn.com/v4/letter/k/5f9b8f/32.png) [@keaoner](https://community.graylog.org/u/keaoner)\
**Post date:** [June 18, 2018, 2:13pm UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/7 "2018-06-18T14:13:10Z")

</div>

Hmmm!!! that good 🙂 thx u  
At what time or in which interface can I configure my graylog input to write in this or that index (prefixed) elasticsearch?

---

<div class="post-metadata">

**Author:** ![keaoner](https://avatars.discourse-cdn.com/v4/letter/k/5f9b8f/32.png) [@keaoner](https://community.graylog.org/u/keaoner)\
**Post date:** [June 19, 2018, 10:20am UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/8 "2018-06-19T10:20:09Z")

</div>

Hi @Jochen you need:

1 - create an “index set”  
2 - create a stream with a rule to redirect to the “Index-set” that I just created.

That’s right???

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 3, 2018, 10:20am UTC](https://community.graylog.org/t/3-differents-data-set-to-3-differents-input-graylog-to-3-differnets-es-index-with-different-prefix/5635/9 "2018-07-03T10:20:16Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
