# Give logstash two different log files with filebeat but i only get one in Elasticsearch
**URL:** https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749
**Category:** Logstash
**Created:** [May 13, 2019, 7:10am UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749 "2019-05-13T07:10:31Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Axel\_Kruger](https://discuss.elastic.co/u/Axel_Kruger)
#### Post date: [May 13, 2019, 7:10am UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749/1 "2019-05-13T07:10:31Z")
Hey,
i'v got the problem that i have only one input in to logstash via filebeat but two difrent logfiles, a liferaylog an a apache Acceess\_log. i can see that filebeat analyse that two files and send it tp logstash.
INPUT 01-input.conf :
input {
beats {
client\_inactivity\_timeout =\> 120
port =\> 5044
ssl =\> true
ssl\_certificate =\> "/etc/pki/tls/certs/test-server.ag.crt"
ssl\_key =\> "/etc/pki/tls/private/test-server.ag.p8"
}
}
FILTER 1 - 02-liferay.conf
filter {
grok {
match =\> {
"message" =\> "%{MONTHDAY:day}\s+%{MONTH:month}\s+%{YEAR:year}\s+%{TIME:time}\s+[%{GREEDYDATA:host}]\s+%{LOGLEVEL:loglevel}\s+[(?([-a-zA-Z/\_0-9]_))][][(?([-a-zA-Z/\_0-9:]_))]\s+(?(.\*))"
}
}
}
INPUT 2 - 03-apache.conf
filter {
grok {
match =\> {
"message" =\> "(?(?:[[a-zA-Z0-9-]+]))\s+|\s+%{IP:ip}\s+-\s+-\s+(?([[0-9]{2}/[A-Za-z]_/[0-9]_:[0-9:]_\s++[0-9]_]))\s+(?([0-9/]_))\s+"(?((GET|DELETE|POST|INSERT|UPDATE)))\s+%{URIPATH:resource}\s+HTTP/%{NUMBER:httpversion}"\s+(?(([0-9]_)))\s+(?(([0-9]_)))\s+"(?((([(http)|(https)]_:[/]_[a-zA-Z0-9./-]_))))"\s+"(?((.\*)))""
}
}
}
OUTPUT 99-ouput.conf
output {
stdout { codec =\> rubydebug }
```
elasticsearch {
hosts => "localhost:9200"
index => "logstash-%{+YYYY.MM.dd}"
}
```
}
The Problem is that i can't finde the Apache Accesslog in my KIBANA. WHats the problem? Have i to configure to inputs for two different filetypes with a different PORT?
best regards Axel
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [May 13, 2019, 7:19am UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749/2 "2019-05-13T07:19:35Z")
Hi @Axel_Kruger,
what does your Filebeat config look like? Especially the inputs.
> [@Axel\_Kruger](#):
>
> Have i to configure to inputs for two different filetypes with a different PORT?
You can use the same port for all logs shipped from Filebeat 🙂
---
### Author:  [@Axel\_Kruger](https://discuss.elastic.co/u/Axel_Kruger)
#### Post date: [May 13, 2019, 7:41am UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749/3 "2019-05-13T07:41:05Z")
Hey A\_B,
my FB inputs look like this
#=========================== Filebeat inputs =============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [May 13, 2019, 7:45am UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749/4 "2019-05-13T07:45:50Z")
That would be much easier to read if you would use `` from the tools to format it as _Preformatted text_.
I can't see any mention of Apache logs there.
---
### Author:  [@Axel\_Kruger](https://discuss.elastic.co/u/Axel_Kruger)
#### Post date: [May 13, 2019, 8:51am UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749/5 "2019-05-13T08:51:54Z")
filebeat.inputs:
- type: log
enabled: true
- /opt/liferay/logs/liferay\*.log
- /opt/httpd/logs/access\_log
i dont have configure special filebeat apache logs, i only have set the path to the logfiles in the filebeat config.
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [May 13, 2019, 11:04am UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749/6 "2019-05-13T11:04:22Z")
Right, I should have seen that.
Not sure if you can have two completely separate `filter` configs, someone else will have to comment on that.
_If_ it is possible to have several `filter` blocks in the config, then you are trying to grok the `message` field twice. You would probably want to add `if` statements and add some fields that you can use for that logic. You can [add fields](https://www.elastic.co/guide/en/beats/filebeat/7.0/filebeat-input-log.html#filebeat-input-log-fields) in Filebeat easily.
I have all my filters in one file, inside one `filter {}`.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 13, 2019, 1:54pm UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749/7 "2019-05-13T13:54:01Z")
> [@A\_B](#):
>
> Not sure if you can have two completely separate `filter` configs, someone else will have to comment on that.
@Axel_Kruger @A_B Yes, you can distribute filters across multiple files. logstash will concatenate the files, then start compiling. So, stupid as it might be, if you point a pipeline at directory containing these 4 files, it will work as if all the configuration were in one file, because by the time it starts compiling, effectively it is one file.
a.conf
```
input {
generator { count => 1 lines => [''] }
}
filter {
```
b.conf
```
json { source => "message" }
if [foo] != "bar" {
mutate {
```
c.conf
```
add_field => {
"hello" => "world!"
}
}
```
d.conf
```
}
}
output {
stdout { codec => rubydebug { metadata => false } }
}
```
That said, both grok filters will apply to both types of files, so you will always get \_grokparsefailure tags. Also, the patterns are not anchored, so it will be expensive for them to fail, since they will backtrack a lot. The configuration would be a lot cheaper if they were anchored to beginning of line with ^
```
"message" => "^%{MONTHDAY:day}\s+%{MONTH:month}\s+%{YEAR:year}\s+%{TIME:time}\s+...
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 10, 2019, 1:54pm UTC](https://discuss.elastic.co/t/give-logstash-two-different-log-files-with-filebeat-but-i-only-get-one-in-elasticsearch/180749/8 "2019-06-10T13:54:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.