# Filebeat multiple input log files with condition

**URL:** <https://discuss.elastic.co/t/filebeat-multiple-input-log-files-with-condition/233251>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 19, 2020, 6:21am UTC](https://discuss.elastic.co/t/filebeat-multiple-input-log-files-with-condition/233251 "2020-05-19T06:21:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mohammad\_Mousavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohammad_mousavi/32/56508_2.png) [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\
**Post date:** [May 19, 2020, 6:21am UTC](https://discuss.elastic.co/t/filebeat-multiple-input-log-files-with-condition/233251/1 "2020-05-19T06:21:46Z")

</div>

Hi, I have 2 input files. access and error nginx log files. in one of them I need just specific lines.  
I thought this might work but it doesn't.

> paths:  
> - /var/log/nginx/myapp-access.log  
> fields: {log\_type: myapp-media}  
> path:  
> - /var/log/nginx/myapp-error.log  
> fields: {log\_type: myapp-media-error}  
> include\_lines: ['dl-apk']

The `include_lines: ['dl-apk']` seems to apply for both of input files, not only for the second one.  
How should I config this ?  
Thanx

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [May 19, 2020, 7:46am UTC](https://discuss.elastic.co/t/filebeat-multiple-input-log-files-with-condition/233251/2 "2020-05-19T07:46:39Z")

</div>

Most likely your configuration file is not correct. Take a look at different example of multi-input setup: [Multiple Filebeat inputs with logstash output](https://discuss.elastic.co/t/multiple-filebeat-inputs-with-logstash-output/146343)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2020, 7:46am UTC](https://discuss.elastic.co/t/filebeat-multiple-input-log-files-with-condition/233251/3 "2020-06-16T07:46:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.