# ELK : logstash with 3 different beats inputs on different ports with 3 different indexes

**URL:** <https://discuss.elastic.co/t/elk-logstash-with-3-different-beats-inputs-on-different-ports-with-3-different-indexes/239318>\
**Category:** Logstash\
**Created:** [June 30, 2020, 1:50pm UTC](https://discuss.elastic.co/t/elk-logstash-with-3-different-beats-inputs-on-different-ports-with-3-different-indexes/239318 "2020-06-30T13:50:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![olivierdrueuil](https://avatars.discourse-cdn.com/v4/letter/o/ba8739/32.png) [@olivierdrueuil](https://discuss.elastic.co/u/olivierdrueuil)\
**Post date:** [June 30, 2020, 1:50pm UTC](https://discuss.elastic.co/t/elk-logstash-with-3-different-beats-inputs-on-different-ports-with-3-different-indexes/239318/1 "2020-06-30T13:50:11Z")

</div>

hello

I have setup an ELK with 3 beats configurations for 3 different services : httpd,mysql,ibm MQ  
\<[root@elktest20 conf.d]# pwd  
/etc/logstash/conf.d  
[root@elktest20 conf.d]# ls  
02-beats-mysql.conf 03.beats-mq.conf 04.beats-httpd.conf  
[root@elktest20 conf.d]#/\>  
the 3 inputs are running on different ports : 5044 for mysql, 5045 for httpd,5046 for MQ.  
I have also used 3 different indexes for each ports/services regarding the output:  
e.g for MQ  
\<output {  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
index =\> "filebeat-7.8.0-mq%"  
}  
stdout { codec =\> rubydebug }  
}  
/\>  
e.g for HTTPD  
\<output {  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
index =\> "filebeat-7.8.0-httpd-%"  
}  
stdout { codec =\> rubydebug }  
}  
/\>  
but when i crawl the logs in the kibana, it doesn't care about the index. I mean , for example, my MQ logs have the index filebeast-7.8.0-httpd when I expect to get filebeat-7.8.0-mq.  
How is it possible and how to get the proper index associated to the expected port ?  
I precise I use the good port configuration for my filebeat clients to send the logs to logstash

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2020, 1:50pm UTC](https://discuss.elastic.co/t/elk-logstash-with-3-different-beats-inputs-on-different-ports-with-3-different-indexes/239318/2 "2020-07-28T13:50:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.