Hi Russell,
Yes, you are right, they are combined as a single Logstash pipeline. Logstash follows the UNIX way for merging the files and creating a single channel. The issue has been discussed here:
If you have multiple inputs, it would make sense to probably use the Multiple Pipeline feature in Logstash.
Your issue is mostly with how logstash merges your files. Could you probably follow a pattern similar to this:
### Input Section ###
10_input_beats.conf
10_input_syslog.conf
### End ###
### Filter Section ###
10_filter_syslog.conf
20_filter_syslog.conf
10_filter_beats.conf
### End ###
### Output Section ###
10_output.conf
### End ###
This will ensure your filters are applied in the correct order and they work.