# 2 nodes logstash
**URL:** https://discuss.elastic.co/t/2-nodes-logstash/320012
**Category:** Kibana
**Created:** [November 29, 2022, 8:33am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012 "2022-11-29T08:33:35Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@maxxl](https://discuss.elastic.co/u/maxxl)
#### Post date: [November 29, 2022, 8:33am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/1 "2022-11-29T08:33:35Z")
1 logstash works fine
2 logstash, wrong view in kibana
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 29, 2022, 9:20am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/2 "2022-11-29T09:20:51Z")
Welcome to our community! 😃
It's not clear what your problem is sorry, can you elaborate?
---
### Author:  [@maxxl](https://discuss.elastic.co/u/maxxl)
#### Post date: [November 29, 2022, 1:50pm UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/3 "2022-11-29T13:50:11Z")
I see a "Node:1" in the "Nodes" tab, but should see "Nodes:2"
probably
refreshing the page
I see either the first or the second node
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 29, 2022, 1:55pm UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/4 "2022-11-29T13:55:52Z")
How are you monitoring Logstash?
What does the `logstash.yml` of each server looks like? Please share it.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 29, 2022, 3:20pm UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/8 "2022-11-29T15:20:09Z")
Can you please format your posts using the Preformatted text button, the `` button? It is really hard to understand your configurations without it.
Or put the configuration files between three single quotes, like this:
```
configuration
```
Also, you didn't share the `logstash.yml` of your nodes.
---
### Author:  [@maxxl](https://discuss.elastic.co/u/maxxl)
#### Post date: [November 30, 2022, 5:32am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/9 "2022-11-30T05:32:52Z")
logstesh node1logstash
/etc/logstash/conf.d/logstash-sample.conf
```auto
input {
beats {
port => 5044
id => "beats-id_telk-logstash"
}
}
filter {
if "pole" in [tags] {
grok {
match => { "message" => ["%{NUMBER:UPID}\|%{TIME:LOGTIME}\|\s*%{GREEDYDATA:Services}\|%{GREEDYDATA:Message}"] }
}
}
}
output {
elasticsearch {
hosts => ["https://172.22.189.188:9200"]
id => "elastic-id_telk-logstash"
#index => "test-servers-%{+YYYY.MM.dd}"
user => "elastic"
password => "7QWyjr7Hr=8Rbo_rtg*C"
ssl => true
cacert => "/etc/logstash/http_ca.crt"
}
}
```
logstesh node1 pipelines
/etc/logstash/pipelines.yml
```auto
pipeline.id: pipeline-telk-logstash
path.config: "/etc/logstash/conf.d/*.conf"
```
logstesh node1 metricbeat
```auto
/etc/metricbeat/modules.d/logstash-xpack.yml
- module: logstash
xpack.enabled: true
period: 10s
hosts: ["localhost:9600"]
#username: "user"
#password: "secret"
metricsets: ["node", "node_stats"]
period: 10s
ssl.enabled: true
ssl.certificate_authorities: ["/etc/metricbeat/http_ca.crt"]
```
logstesh node2 logstash
/etc/logstash/conf.d/logstash-sample.conf
```auto
input {
beats {
port => 5044
id => "beats-id_telk-logstash2"
}
}
filter {
if "pole" in [tags] {
grok {
match => { "message" => ["%{NUMBER:UPID}\|%{TIME:LOGTIME}\|\s*%{GREEDYDATA:Services}\|%{GREEDYDATA:Message}"] }
}
}
}
output {
elasticsearch {
hosts => ["https://172.22.189.188:9200"]
id => "elastic-id_telk-logstash2"
#index => "test-servers-%{+YYYY.MM.dd}"
user => "elastic"
password => "7QWyjr7Hr=8Rbo_rtg*C"
ssl => true
cacert => "/etc/logstash/http_ca.crt"
}
}
```
logstesh node2 pipelines
/etc/logstash/pipelines.yml
```auto
pipeline.id: pipeline-telk-logstash2
path.config: "/etc/logstash/conf.d/*.conf"
```
logstesh node2 metricbeat
```auto
/etc/metricbeat/modules.d/logstash-xpack.yml
- module: logstash
xpack.enabled: true
period: 10s
hosts: ["localhost:9600"]
#username: "user"
#password: "secret"
metricsets: ["node", "node_stats"]
period: 10s
ssl.enabled: true
ssl.certificate_authorities: ["/etc/metricbeat/http_ca.crt"]
```
---
### Author:  [@maxxl](https://discuss.elastic.co/u/maxxl)
#### Post date: [November 30, 2022, 8:11am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/10 "2022-11-30T08:11:52Z")
formatted
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 30, 2022, 2:09pm UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/11 "2022-11-30T14:09:06Z")
> [@leandrojmp](#):
>
> Also, you didn't share the `logstash.yml` of your nodes.
The `logstahs.yml` is still missing, the one in `/etc/logstash`.
You need to share the file of both of your nodes.
---
### Author:  [@maxxl](https://discuss.elastic.co/u/maxxl)
#### Post date: [December 1, 2022, 5:48am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/12 "2022-12-01T05:48:46Z")
telk-logstash1
```auto
telk-logstash1: cat /etc/logstash/logstash.yml |grep -v '#'
path.data: /var/lib/logstash
path.logs: /var/log/logstash
```
telk-logstash2
```auto
telk-logstash2: cat /etc/logstash/logstash.yml |grep -v '#'
path.data: /var/lib/logstash
path.logs: /var/log/logstash
```
---
### Author:  [@maxxl](https://discuss.elastic.co/u/maxxl)
#### Post date: [December 5, 2022, 6:26am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/13 "2022-12-05T06:26:35Z")
shared
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2023, 6:26am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012/14 "2023-01-02T06:26:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.