# How to differentiate between server logs in logstash?

**URL:** <https://discuss.elastic.co/t/how-to-differentiate-between-server-logs-in-logstash/180139>\
**Category:** Logstash\
**Created:** [May 8, 2019, 9:09am UTC](https://discuss.elastic.co/t/how-to-differentiate-between-server-logs-in-logstash/180139 "2019-05-08T09:09:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rplus](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@rplus](https://discuss.elastic.co/u/rplus)\
**Post date:** [May 8, 2019, 9:09am UTC](https://discuss.elastic.co/t/how-to-differentiate-between-server-logs-in-logstash/180139/1 "2019-05-08T09:09:37Z")

</div>

Hi,

First of all i'm not sure it this is the right place to post this, but i'll give it a shot.

I've several windows servers running filebeat sending IIS logs to logstash. I need some way to differentiate between them to be able to tell which server sent which log so that I at some time later in Kibana can view data from "all logs from server X". What's a good solution to this?

An example would be greatly appreciated.

Logstash configuration:

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
grok {match =\> ["message", "%{TIMESTAMP\_ISO8601:log\_timestamp} %{IP:serverIP} %{WORD:method} %{URIPATH:uriStem} %{NOTSPACE:uriQuery} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clientIP} %{NOTSPACE:userAgent} %{NOTSPACE:referer} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:win32response} %{NUMBER:timetaken}"]  
}  
}

output {  
elasticsearch {  
hosts =\> ["[http://X.X.X.X:9200](http://X.X.X.X:9200)"]  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}

Best regards  
Rasmus Gärdekrans

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 8, 2019, 1:05pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-server-logs-in-logstash/180139/2 "2019-05-08T13:05:31Z")

</div>

By default filebeat will include metadata about which host it is running on and which file it is reading in the events that it sends to logstash. So you should already have this ability.

---

<div class="post-metadata">

**Author:** ![rplus](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@rplus](https://discuss.elastic.co/u/rplus)\
**Post date:** [May 9, 2019, 11:22am UTC](https://discuss.elastic.co/t/how-to-differentiate-between-server-logs-in-logstash/180139/3 "2019-05-09T11:22:22Z")

</div>

Thanks for you reply!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2019, 11:22am UTC](https://discuss.elastic.co/t/how-to-differentiate-between-server-logs-in-logstash/180139/4 "2019-06-06T11:22:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.