# Help - Logstash multiple logs in single output

**URL:** <https://discuss.elastic.co/t/help-logstash-multiple-logs-in-single-output/352746>\
**Category:** Logstash\
**Created:** [February 7, 2024, 12:00pm UTC](https://discuss.elastic.co/t/help-logstash-multiple-logs-in-single-output/352746 "2024-02-07T12:00:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CDY1911](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@CDY1911](https://discuss.elastic.co/u/CDY1911)\
**Post date:** [February 7, 2024, 12:00pm UTC](https://discuss.elastic.co/t/help-logstash-multiple-logs-in-single-output/352746/1 "2024-02-07T12:00:11Z")

</div>

Hi,

Im currently stuck surrounding why my testfile is not outputting both types of logs (flow\_logs and URL\_logs). I've ran these both separately and they work fine

However once i run the following code below. Im only outputting URL logs only

Could anybody please assist?

```auto
input {
     syslog {
         port => 510
         type => "flow_logs"
    }
	syslog {
	     port => 511
         type => "url_logs"
    }
}    

filter {
 if [type] == "flow_logs" {
  grok {
    match => { "message" => "%{NUMBER:Priority}>%{NUMBER:Version} %{NUMBER:Timestamp} %{WORD:Host} %{WORD:LogType} %{WORD:Action} src=%{IPV4:SourceIP} dst=%{IPV4:DestIP} mac=%{MAC:MAC} protocol=%{WORD:Protocol} sport=%{INT:Source_Port} dport=%{INT:Dest_Port}"} 
	}
  prune {
        whitelist_names => ["^Priority$" , "^Version$" , "^Timestamp$" , "^Host$" , "^LogType$" , "^Action$" , "^SourceIP$" , "^DestIP$" , "^MAC$" , "^Protocol$" , "^Source_Port$" , "^Dest_Port$"]
        }
    }
 if [type] == "url_logs" {
  grok {
	match => { "message" => "<%{NUMBER:Priority}>%{NUMBER:Version} %{NUMBER:Timestamp} %{WORD:Host} %{WORD:LogType} src=%{IPV4:SourceIP}:%{IPORHOST:SourcePort} dst=%{IPV4:DestIP}:%{IPORHOST:DestPort} mac=%{MAC:MAC} (agent='%{DATA:User_Agent}' )?request: %{DATA:Request} %{GREEDYDATA:URL}..."}
	}
  prune {
        whitelist_names => ["^Priority$" , "^Version$" , "^Timestamp$" , "^Host$" , "^LogType$" , "^SourceIP$" , "^SourcePort$" , "^DestIP$" , "^DestPort$" , "^MAC$" , "^User_Agent$" , "^Request$" , "^URL$"]
        }
    }
}

output {
    microsoft-sentinel-logstash-output-plugin {
        create_sample_file => true
        sample_file_path => "/tmp/logstash/"
    }
}

```

---

<div class="post-metadata">

**Author:** ![CDY1911](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@CDY1911](https://discuss.elastic.co/u/CDY1911)\
**Post date:** [February 7, 2024, 12:24pm UTC](https://discuss.elastic.co/t/help-logstash-multiple-logs-in-single-output/352746/2 "2024-02-07T12:24:57Z")

</div>

Also attempted to use "ELSE IF [type] == "url\_logs" "

This then only outputs the flow logs and not the url logs

---

<div class="post-metadata">

**Author:** ![CDY1911](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@CDY1911](https://discuss.elastic.co/u/CDY1911)\
**Post date:** [February 7, 2024, 1:39pm UTC](https://discuss.elastic.co/t/help-logstash-multiple-logs-in-single-output/352746/3 "2024-02-07T13:39:41Z")

</div>

Fixed. Sample fix limits amount of logs. Extracted to standard file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2024, 1:39pm UTC](https://discuss.elastic.co/t/help-logstash-multiple-logs-in-single-output/352746/4 "2024-03-06T13:39:58Z")

</div>

Closed on March 6, 2024, 1:39pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.