# 5 logs for every audit event
**URL:** https://discuss.elastic.co/t/5-logs-for-every-audit-event/201864
**Category:** Logstash
**Created:** [October 1, 2019, 8:32pm UTC](https://discuss.elastic.co/t/5-logs-for-every-audit-event/201864 "2019-10-01T20:32:09Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@crazedmeph](https://discuss.elastic.co/u/crazedmeph)
#### Post date: [October 1, 2019, 8:32pm UTC](https://discuss.elastic.co/t/5-logs-for-every-audit-event/201864/1 "2019-10-01T20:32:10Z")
I am testing out how auditbeats work and upon logging into the box that auditbeat is enabled I get 5 authentication\_success messages. All 5 of the logs are exactly the same, the only value that is not the same is the \_id field.
after digging in for awhile I found out that it came down to logstash pulling data from kafka.
I have 5 different configs auditbeat.conf, filebeat.conf, heartbeat.conf, metricbeat.conf and packetbeat.conf all with different topics to pull from. The problem is it is not only pulling from that topic, it is pulling from all topics that i have in those config files.
All of the files look almost identical to this except for the "topics" part
```
input {
kafka {
bootstrap_servers => "kafkaBootstrapServer:6667"
topics => ["auditbeat"]
codec => json
}
}
output{
elasticsearch {
hosts => ["LOTS OF HOSTS"]
user => "myUser"
password => "myPass"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
```
Am i not able to have multiple config files with different topics? I wanted to separate them.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 1, 2019, 9:30pm UTC](https://discuss.elastic.co/t/5-logs-for-every-audit-event/201864/2 "2019-10-01T21:30:56Z")
Take a look at [this](https://discuss.elastic.co/t/logstash-pipeline-output-duplicate-messages-ending-up-indexes/199878/4) thread.
---
### Author:  [@crazedmeph](https://discuss.elastic.co/u/crazedmeph)
#### Post date: [October 2, 2019, 1:19pm UTC](https://discuss.elastic.co/t/5-logs-for-every-audit-event/201864/3 "2019-10-02T13:19:16Z")
Very interesting, Thanks for this!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 30, 2019, 1:19pm UTC](https://discuss.elastic.co/t/5-logs-for-every-audit-event/201864/4 "2019-10-30T13:19:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.