# How to send logs from specific source to specific index

**URL:** <https://forum.opensearch.org/t/how-to-send-logs-from-specific-source-to-specific-index/9228>\
**Category:** Index Management\
**Tags:** configure\
**Created:** [April 13, 2022, 11:51am UTC](https://forum.opensearch.org/t/how-to-send-logs-from-specific-source-to-specific-index/9228 "2022-04-13T11:51:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AndreyB](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@AndreyB](https://forum.opensearch.org/u/AndreyB)\
**Post date:** [April 13, 2022, 11:51am UTC](https://forum.opensearch.org/t/how-to-send-logs-from-specific-source-to-specific-index/9228/1 "2022-04-13T11:51:26Z")

</div>

I’m trying to send logs from specific source to specific index.  
So in logstash.conf i did the following:

```auto
input {                                                                                                                                                                             
 gelf {                                                                                                                                                                             
    port => 12201                                                                                                                                                                   
# type => docker                                                                                                                                                                 
    use_tcp => true                                                                                                                                                                 
    tags => ["docker"]                                                                                                                                                              
  }

filter {
if "test_host" in [_source][host] {                                                                                                                                              
   mutate { add_tag => "test_host"}                                                                                                                                              
   }

output {
   if "test_host" in [tags] {                                                                                                                                               
   stdout { }                                                                                                                                                                       
   opensearch {                                                                                                                                                                     
    hosts => ["https://opensearch:9200"]                                                                                                                                      
    index => "my_host_index"                                                                                                                                                              
    user => "administrator"                                                                                                                                                                 
    password => "some_password"                                                                                                                                                     
    ssl => true                                                                                                                                                                     
    ssl_certificate_verification => false                                                                                                                                           
    }
 } 

```

But unfortunately it’s not working.  
What am i doing wrong?

Thanks.

---

<div class="post-metadata">

**Author:** ![nateynate](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nateynate/32/4913_2.png) [@nateynate](https://forum.opensearch.org/u/nateynate)\
**Post date:** [April 15, 2022, 4:38pm UTC](https://forum.opensearch.org/t/how-to-send-logs-from-specific-source-to-specific-index/9228/2 "2022-04-15T16:38:05Z")

</div>

Hi @AndreyB - is there any output from Logstash that you could share here? The configuration looks syntactically correct to me, perhaps we could deduce a bit from the behavior.

Are events from the gelf plugin at least making it to STDOUT? Or do they not even make it to the output stanza? If its the latter, I suspect the `if` conditional might not be correct.

Share with us what you can for a bit more clarification - I’d love to help out here.