Beats Received on Port 11001 Are Being Processed By Port 11000 Config

Elastic Stack Logstash
4

Unless you're using Logstash 6 multiple pipelines, all your pipeline configurations are essentially merged into one.

In your example events will be received by both inputs (ports 11000 & 11001), and output to both logstash:11000 & logstash:11001. The alternative to using multiple pipelines is to tag events on your inputs, and then wrap the outputs in conditionals:

i.e.

Input:

input {
    beats {
        id => "appa_beats"
        client_inactivity_timeout => 1200
        port => 11000
        tags => ["appa"]
    }
}

or

input {
    beats {
        id => "appa_beats"
        client_inactivity_timeout => 1200
        port => 11000
        type => "appa"
    }
}

(I'd do some reading before using type though, as it's deprecated: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/removal-of-types.html)

Output:

output {
  if "appa" in [tags] {
    logstash {
      # The Logstash hosts
      hosts: ["logstash:11000"]
    }
  }
}

Ultimately though I'd definitely suggest looking at using multiple pipelines. It'll help keep your configuration cleaner as there's less need for confusing conditionals, and also limits the blast radius on outputs being down, filter crashes etc.