# 2 types of input

**URL:** <https://discuss.elastic.co/t/2-types-of-input/160402>\
**Category:** Logstash\
**Created:** [December 11, 2018, 3:27pm UTC](https://discuss.elastic.co/t/2-types-of-input/160402 "2018-12-11T15:27:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fooc](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@fooc](https://discuss.elastic.co/u/fooc)\
**Post date:** [December 11, 2018, 3:27pm UTC](https://discuss.elastic.co/t/2-types-of-input/160402/1 "2018-12-11T15:27:22Z")

</div>

Hi,

I'm using a logstash-utm.conf file to process syslog data from a firewall, this is working fine.  
I also want to send data from winlogbeat on a windows server to logstash, is it best practice to add new input and output to the existing logstash-utm.conf?

This is my current conf file:

input {  
tcp {  
port =\> 5140  
}  
udp {  
port =\> 5140  
}  
}

filter {  
grok {  
match =\> { "message" =\> "\<%{POSINT:syslog\_pri}\>%{DATA:syslog\_timestamp} %{SYSLOGHOST:syslog\_host} %{DATA:syslog\_program}[%{NUMBER:syslog\_pid}]: %{GREEDYDATA:syslog\_message}" }  
}  
date {  
match =\> ["syslog\_timestamp", "yyyy:MM:dd-HH:mm:ss"]  
}  
kv {  
source =\> "syslog\_message"  
}  
mutate {  
replace =\> ["type", "%{syslog\_program}"]  
remove\_field =\> ["syslog\_message", "syslog\_timestamp"]  
}

if [type] == "httpproxy" {  
grok { match =\> { "url" =\> "(?https?)://%{IPORHOST:url\_domain}/" } }

}  
geoip {  
source =\> "dstip"  
}  
geoip {  
source =\> "srcip"  
}

} # end of filter

output {

elasticsearch {  
hosts =\> ["10.255.254.27:9200"]  
index =\> "logstash-utm-%{+YYYY.MM.dd}"

}

# stdout { codec =\> rubydebug }

}

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [December 11, 2018, 4:02pm UTC](https://discuss.elastic.co/t/2-types-of-input/160402/2 "2018-12-11T16:02:55Z")

</div>

You can have many instances of the same input in one config but obviously they can't "step on each others toes" i.e. have the same listening port, reading the same files or fetching the same records.

You should consider using the `type` setting. It will add a field called `type` that you can use in conditionals to apply some logic to one source and not the other.

Also you can use multiple pipelines in one instance to separate the concerns. Two input + filter pipelines can feed into a common output pipeline. Here is [the link to the multi-pipeline docs](https://www.elastic.co/guide/en/logstash/6.3/multiple-pipelines.html)

---

<div class="post-metadata">

**Author:** ![fooc](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@fooc](https://discuss.elastic.co/u/fooc)\
**Post date:** [December 12, 2018, 3:57pm UTC](https://discuss.elastic.co/t/2-types-of-input/160402/3 "2018-12-12T15:57:30Z")

</div>

Something like this?

input {  
tcp {  
port =\> 5140  
}  
udp {  
port =\> 5140  
beats {  
type =\> "winlogbeat"  
port =\> 5044  
}

filter {  
grok {  
match =\> { "message" =\> "\<%{POSINT:syslog\_pri}\>%{DATA:syslog\_timestamp} %{SYSLOGHOST:syslog\_host} %{DATA:syslog\_program}[%{NUMBER:syslog\_pid}]: %{GREEDYDATA:syslog\_message}" }  
}  
date {  
match =\> ["syslog\_timestamp", "yyyy:MM:dd-HH:mm:ss"]  
}  
kv {  
source =\> "syslog\_message"  
}  
mutate {  
replace =\> ["type", "%{syslog\_program}"]  
remove\_field =\> ["syslog\_message", "syslog\_timestamp"]  
}

if [type] == "httpproxy" {  
grok { match =\> { "url" =\> "(?https?)://%{IPORHOST:url\_domain}/" } }

}  
geoip {  
source =\> "dstip"  
}  
geoip {  
source =\> "srcip"  
}

} # end of filter

output {  
if [type] == "winlogbeat" {  
elasticsearch { index =\> "logstash-winlogbeat-%{YYYY.mm.dd}"  
} else {  
elasticsearch {  
hosts =\> ["10.255.254.27:9200"]  
index =\> "logstash-utm-%{+YYYY.MM.dd}"

}

# stdout { codec =\> rubydebug }

}

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [December 12, 2018, 4:56pm UTC](https://discuss.elastic.co/t/2-types-of-input/160402/4 "2018-12-12T16:56:03Z")

</div>

Sure, that is OK (except there is a typo, no closing `}` for udp) but I mean exactly the same input plugin, e.g.:

```auto
input {
  tcp {
    port => 5140
    type => "app-A"
  }
  tcp {
    port => 5141
    type => "app-B"
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2019, 4:56pm UTC](https://discuss.elastic.co/t/2-types-of-input/160402/5 "2019-01-09T16:56:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.