# Filebeat -\> Logstash -\> ElasticSearch with multiple outputs

**URL:** https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598
**Category:** Elasticsearch
**Created:** [March 18, 2021, 5:54am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598 "2021-03-18T05:54:56Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Satyat500](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Satyat500](https://discuss.elastic.co/u/Satyat500)
#### Post date: [March 18, 2021, 5:54am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598/1 "2021-03-18T05:54:56Z")

</div>

Hi team,  
I am trying to send output to two different index by taking two different inputs in tcp and beats. I am able to send logs to elasticsearch which are coming from filebeat but I am not able to send the logs to logstash index which are coming from a different source in form of tcp. Below is the configuration for the same. Am I doing something wrong?

```auto
input {
    tcp {
        port => 9600
        tags => ["tcp"]
        type => "tcp"
    }
    beats {
        port => 5044
        tags => ["beats"]
        type => "beats"
    }
}

filter {}

output {
        if "beats" in [tags] {
                elasticsearch {
                        hosts => ["localhost:9200"]
                        index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
                        }
                }
       if "tcp" in [tags] {
                stdout {
                        codec => json
                }
                elasticsearch {
                        hosts => ["localhost:9200"]
                        index => "logstash-%{+YYYY.MM.dd}"
                        }
                }
        }

```

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 18, 2021, 6:10am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598/2 "2021-03-18T06:10:38Z")

</div>

Do you have data coming in through TCP? Do you get output to stdout? Are there any filters that could be causing problems?

Document types are being deprecated in Elasticsearch so I would recommend not setting the type in the inputs as this could cause problems, at least down the line.

---

<div class="post-metadata">

### Author: ![Satyat500](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Satyat500](https://discuss.elastic.co/u/Satyat500)
#### Post date: [March 18, 2021, 6:42am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598/3 "2021-03-18T06:42:27Z")

</div>

Hi @Christian_Dahlqvist

No data is coming in through TCP. So, no output to stdout. I am confused why it's not coming. Sending you the part of the configuration file from where I am sending the logs to logstash:

```auto
         "logstash": {
             "level": "DEBUG",
             "class": "logstash_async.handler.AsynchronousLogstashHandler",
             "transport": "logstash_async.transport.TcpTransport",
             "formatter": "simple",
             "host": "Logstash host",
             "port": 9600,
             "version": 1,
             "message_type": "python-logstash", # "type" field in logstash message; default value: "logstash"
             "fqdn": False, # fully qualified domain name; default value: false
             "extra_prefix": "dev",
             "tags": ["tcp"],
             "database_path": "{}/logstash.db".format(BASE_DIR),
         }

```

There are no filter set as of now.

Which process would you recommend instead of Document type? I tried other options too, but nothing is working. Can you please help?

---

<div class="post-metadata">

### Author: ![Satyat500](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Satyat500](https://discuss.elastic.co/u/Satyat500)
#### Post date: [March 22, 2021, 11:06am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598/4 "2021-03-22T11:06:53Z")

</div>

Hey,

It would be helpful if someone can guide us

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 22, 2021, 11:09am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598/5 "2021-03-22T11:09:14Z")

</div>

If no data is coming in on TCP I assume you need to check the systems sending that data and check progress step by step. I am not sure how much we can help with that.

---

<div class="post-metadata">

### Author: ![Satyat500](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Satyat500](https://discuss.elastic.co/u/Satyat500)
#### Post date: [March 22, 2021, 11:20am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598/6 "2021-03-22T11:20:39Z")

</div>

We are getting data in beats but not in tcp.

What might be the possible problem?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 22, 2021, 11:39am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598/7 "2021-03-22T11:39:01Z")

</div>

Check the Logstash logs at startup to see if there is any issue with the use of port 9600. It might also be worth changing it to something else and see if that helps as well.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2021, 11:39am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-with-multiple-outputs/267598/8 "2021-04-19T11:39:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
