# Combining several logstash config files into one... how do you do it?

**URL:** https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546
**Category:** Logstash
**Created:** [November 2, 2015, 5:14pm UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546 "2015-11-02T17:14:28Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![jjdepaul](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)
#### Post date: [November 2, 2015, 5:14pm UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546/1 "2015-11-02T17:14:28Z")

</div>

To date, we have created several mini-config files on our own to satisfy very specific goals. Now we are looking to consolidate these files on a common server and wondering how to go about it. Is the best practice to combine all config file statements into one-big-file (with a bunch of conditional statements) and run a single instance of LogStash with that one-big-file?! Is there a way to start logstash with a number of config files? Can you run multiple instances of Logstash, each of which runs a unique config file? Wondering how you all do it. Thx -

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [November 2, 2015, 6:03pm UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546/2 "2015-11-02T18:03:29Z")

</div>

Technically, Logstash will combine all files in a directory if passed a wildcard, e.g. `-f /path/to/configs/*.conf`

It will do so in alphabetical order, so be sure to have them in the order you want.

Of course, you can just concatenate them yourself into a single file, and re-order the blocks as needed. Logstash doesn't care if you have 3 input blocks, 15 filter blocks, and 8 output blocks. It will try to do the right thing in merging them.

---

<div class="post-metadata">

### Author: ![jjdepaul](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)
#### Post date: [November 2, 2015, 6:17pm UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546/3 "2015-11-02T18:17:46Z")

</div>

I like the idea of having multiple config files dedicated to discrete Input/Filter/Output processing - all logic self-contained in unique config file containers.

What I'm not understanding still is, if Logstash is stared with all of these files at once (\*.conf example you used), how will it cope with all these multiple Inputs, multiple Filters and especially multiple Output directives from all these different files representing all the different data types/mappings. Will it always evaluate each Input block, each Filter block and each Output block for each and every data Event?! If so, we will need conditioning to prevent data going to each and every index and making a mess.... Is this what's recommended?

if (datatype == 'billing'), then  
populate 'billing' index...  
else  
if (datatype == 'orders'), then  
populate 'orders' index....  
etc

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 2, 2015, 6:31pm UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546/4 "2015-11-02T18:31:04Z")

</div>

Apart from the options that have been mentioned already you can pass a directory to Logstash and it'll read all files therein.

> Will it always evaluate each Input block, each Filter block and each Output block for each and every data Event?!

Yes.

> If so, we will need conditioning to prevent data going to each and every index and making a mess.... Is this what's recommended?

Yes.

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [November 2, 2015, 6:32pm UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546/5 "2015-11-02T18:32:32Z")

</div>

> [@jjdepaul](#):
>
> Will it always evaluate each Input block, each Filter block and each Output block for each and every data Event?!

Inputs are separate, but yes. Every filter and output will be evaluated for each event, unless you use conditionals to route around them.

> [@jjdepaul](#):
>
> If so, we will need conditioning to prevent data going to each and every index and making a mess.... Is this what's recommended?

Yes. The use of conditionals is the appropriate way to control the flow of streams to various filters and outputs.

---

<div class="post-metadata">

### Author: ![jjdepaul](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)
#### Post date: [November 2, 2015, 6:42pm UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546/6 "2015-11-02T18:42:51Z")

</div>

Thank you both for clarification -

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546/7 "2017-07-06T05:24:28Z")

</div>


