# How does Logstash process Configs? Order that is processes input?
**URL:** https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413
**Category:** Logstash
**Created:** [January 28, 2016, 7:26pm UTC](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413 "2016-01-28T19:26:25Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@jnpetty](https://discuss.elastic.co/u/jnpetty)
#### Post date: [January 28, 2016, 7:26pm UTC](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413/1 "2016-01-28T19:26:25Z")
I have a Syslog tcp input thats my catch all when I cant setup a defined input. Anyway, the input file sets the type as "syslog"
```
tcp {
port => 5140
type => "syslog"
}
```
I then have another config file, called `01-syslog.conf` with a filter for that syslog type
```
filter {
if [type] == "Syslog" {
if [host] =~ /192\.168\.56\.1/ or [host] =~ /192\.168\.56\.2/ {
mutate {
replace => { "type" => "firewall" }
}
}
}
}
```
I then have another config file for the firewall filter `02-firewall.conf`
```
filter {
if [type] == "firewall" {
}
}
```
So my question is how or in what order does Logstash process the configs? I want to make sure that the Syslog filter is processed before the firewall filter since the firewall type is set within the syslog filter. Plus ill probably want to add additional configs down the road.
So there is:
```
00-inputs.conf
01-syslog.conf
02-firewall.conf
...
...
09-futureservice.conf
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 28, 2016, 7:49pm UTC](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413/2 "2016-01-28T19:49:57Z")
The filters are processed for an event in the same order that they've been read from the configuration files, and the files are read in alphabetical order.
I note that your conditional says "Syslog" but the input says "syslog". String comparisons are case-sensitive.
---
### Author:  [@jnpetty](https://discuss.elastic.co/u/jnpetty)
#### Post date: [January 28, 2016, 8:03pm UTC](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413/3 "2016-01-28T20:03:31Z")
> [@magnusbaeck](#):
>
> The filters are processed for an event in the same order that they've been read from the configuration files, and the files are read in alphabetical order.
>
> I note that your conditional says "Syslog" but the input says "syslog". String comparisons are case-sensitive.
Good catch on the case-sensitive, thanks!
So technically the syslog filter would always run before the pfsense filter since the syslog config file is a lower number... 01 vs 02
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 28, 2016, 8:05pm UTC](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413/4 "2016-01-28T20:05:21Z")
> So technically the syslog filter would always run before the pfsense filter since the syslog config file is a lower number... 01 vs 02
Yes.
---
### Author:  [@jnpetty](https://discuss.elastic.co/u/jnpetty)
#### Post date: [January 28, 2016, 8:05pm UTC](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413/5 "2016-01-28T20:05:36Z")
Thanks!!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413/6 "2017-07-06T05:13:53Z")