# Default and Customer Input and Filter Config in diffrent Files on diffrent Servers and System

**URL:** <https://discuss.elastic.co/t/default-and-customer-input-and-filter-config-in-diffrent-files-on-diffrent-servers-and-system/53283>\
**Category:** Logstash\
**Created:** [June 20, 2016, 8:21am UTC](https://discuss.elastic.co/t/default-and-customer-input-and-filter-config-in-diffrent-files-on-diffrent-servers-and-system/53283 "2016-06-20T08:21:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mehrentraut](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@mehrentraut](https://discuss.elastic.co/u/mehrentraut)\
**Post date:** [June 20, 2016, 8:21am UTC](https://discuss.elastic.co/t/default-and-customer-input-and-filter-config-in-diffrent-files-on-diffrent-servers-and-system/53283/1 "2016-06-20T08:21:57Z")

</div>

Hello,

I think I've just not found the right approach, but I am stuck here's my question:

I wonder how I get it, that applies a default input and filter config all scanned files. It nevertheless is possible Custom configs apply.

Example:

For all the logs I need the following:

> ```
> input {
> file {
> type => "generic"
> codec => multiline {
> pattern => "^% {} TIMESTAMP_ISO8601"
> charset => "ISO-8859-1"
> negate => true
> what => "previous"
> multiline_tag => "multiline"
> }
> 
> ```

For LogFiles from dir A

> tags =\> ['logfiles-application-A "]  
> path =\> ["/opt/application-A/log/a/\*.log"]

for LogFiles from dir B

> tags =\> ['logfiles-application-B "]  
> path =\> ["/opt/application-B/log/b/\*.log"]

Tags and paths coming from the developers and are in another file

00\_default\_input.conf (Managed by SysAdmin and include codec)  
10\_application\_a.conf (Input Tags and Path / filter for Application A) rolled out by Dev  
10\_application\_b.conf (Input Tags and Path / filter for Application B) rolled out by Dev  
20\_output.conf (managed from sysadmin)

I hope I can express myself naturally, if something is not understood like ask.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 22, 2016, 11:09am UTC](https://discuss.elastic.co/t/default-and-customer-input-and-filter-config-in-diffrent-files-on-diffrent-servers-and-system/53283/2 "2016-06-22T11:09:10Z")

</div>

> ```
> pattern => "^% {} TIMESTAMP_ISO8601"
> 
> ```

I think you mean:

```
  pattern => "^%{TIMESTAMP_ISO8601}"

```

If I understand your question correctly, wrap the filters in 10\_application\_X.conf in a conditional:

```plaintext
filter {
  if 'logfiles-application-A' in [tags] {
    # existing filters here
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/default-and-customer-input-and-filter-config-in-diffrent-files-on-diffrent-servers-and-system/53283/3 "2017-07-06T04:51:15Z")

</div>

Closed on July 6, 2017, 4:51am UTC