# Collect logs from multiple machine, what needs to be installed? **URL:** \ **Category:** Beats\ **Tags:** beats-development\ **Created:** [April 26, 2023, 12:02pm UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833 "2023-04-26T12:02:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Jay\_Timbadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jay_timbadia/32/86572_2.png) [@Jay\_Timbadia](https://discuss.elastic.co/u/Jay_Timbadia)\ **Post date:** [April 26, 2023, 12:02pm UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833/1 "2023-04-26T12:02:19Z")
Continuing the discussion from [How to collect the logs from multiple machines to my server efficiently?](https://discuss.elastic.co/t/how-to-collect-the-logs-from-multiple-machines-to-my-server-efficiently/135902/8): Hi @jsoriano, really followed the chat. Just one thing, I have logs placed in different machine, so should I install beats there and configure it. I have installed ELK (all three) in different machine. So the way I should proceed is, I should install ONLY beats in machine which has logs, and the machine where ELK is there will take care of everything right? So only beats installation to log machine is required, RIGHT? Thank you! Jay ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 26, 2023, 1:37pm UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833/2 "2023-04-26T13:37:15Z")
Hey @Jay_Timbadia. Yest, you only need to install Filebeat on the machines where you want to collect logs from. In the machines where you are running the Elastic Stack you can also install Beats if you want to collect logs or metrics from there. You can also use elastic-agent now to collect logs. ---
**Author:** ![Jay\_Timbadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jay_timbadia/32/86572_2.png) [@Jay\_Timbadia](https://discuss.elastic.co/u/Jay_Timbadia)\ **Post date:** [April 27, 2023, 5:40am UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833/3 "2023-04-27T05:40:06Z")
Thank you @jsoriano for quick reply. I am also facing one more issue. I have logstash running at 5044 on ELK machine. I have one conf file already existing with TCP input, now I want to create one more conf file for beats input. So should I make different conf file and place both in conf.d and restart logstash, or how? Since I tried above approach, it was not working. Can u pls help? Jay ---
**Author:** ![Jay\_Timbadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jay_timbadia/32/86572_2.png) [@Jay\_Timbadia](https://discuss.elastic.co/u/Jay_Timbadia)\ **Post date:** [April 27, 2023, 6:32am UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833/4 "2023-04-27T06:32:35Z")
Also pls see this chat, [Receive multiple Logstash inputs with TCP, UDP and Beats - #3 by sakshat](https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020/3) this person has two logstash config files, but different logstash port number. So in order to run two different config files, do we need to logstash instance? Or we can run two config files with same port number? Will below one work? ```auto input { beats { port => 5044 type => 3dlog } } filter {} output { elasticsearch { hosts => ["localhost:9200"] index => "logs-%{+yyyy.MM.dd}" } } ``` ```auto input { tcp { port => 5044 type => syslog } } filter { } output { elasticsearch { hosts => ["localhost:9200"] index => "app-logs-%{+yyyy.MM.dd}" } } ``` ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 27, 2023, 8:24am UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833/5 "2023-04-27T08:24:08Z")
Yes, it should be possible to use multiple configuration files, you will need to add them to the `conf.d` directory of your logstash configuration directory, and it seems they need a `.conf` extension. You would need to restart Logstash after modifying the configuration. Take a look to the documentation about configuration files: [Logstash Configuration Files | Logstash Reference [8.7] | Elastic](https://www.elastic.co/guide/en/logstash/8.7/config-setting-files.html) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 27, 2023, 1:53pm UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833/6 "2023-04-27T13:53:56Z")
> [@Jay\_Timbadia](#): > > So in order to run two different config files, do we need to logstash instance? You can run multiple independent configurations on the same logstash instance, just need to configure `pipelines.yml` to point to the configuration files, check the [documentation](https://www.elastic.co/guide/en/logstash/8.7/multiple-pipelines.html) for more information on this. > [@Jay\_Timbadia](#): > > Or we can run two config files with same port number? You can't use the same port in different configurations, you will need to use different ports, if you are using port `5044` on `tcp` input, you cannot use this port on the `beats` input. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 25, 2023, 3:54pm UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833/7 "2023-05-25T15:54:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.