# How to filter data from Filebeats in Logstash **URL:** \ **Category:** Logstash\ **Created:** [December 7, 2015, 9:50pm UTC](https://discuss.elastic.co/t/how-to-filter-data-from-filebeats-in-logstash/36579 "2015-12-07T21:50:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![msmolyak](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@msmolyak](https://discuss.elastic.co/u/msmolyak)\ **Post date:** [December 7, 2015, 9:50pm UTC](https://discuss.elastic.co/t/how-to-filter-data-from-filebeats-in-logstash/36579/1 "2015-12-07T21:50:26Z")
I am designing an ELK stack with ElasticSearch, Logstash and Kibana installed on a dedicated server and Filebeats installed on all the machine generating log files. Sounds like a standard setup. My question is how to configure that connection between Filebeats and Logstash to post-process logs in Logstash before sending them to ElasticSearch. Specifically, I have two types of log files, JSON-formatted logs from a NodeJS app and Nginx logs. I need a mechanism to distinguish between these two types of input in Logstash. The examples I could find simply indicate that Logstash receives its inputs from Filebeats. But to convert Nginx files to JSON before insterting them to ElasticSearch I need to distinguish between Filebeats with Nginx logs and Filebeats with Node.js logs. How do I do that? Or should I be processing logs (by converting them to JSON) in Filebeats before sending them to Logstash? Thank you, Michael ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 8, 2015, 3:54am UTC](https://discuss.elastic.co/t/how-to-filter-data-from-filebeats-in-logstash/36579/2 "2015-12-08T03:54:39Z")
It's going to be better to have Filebeat send the files to different ports on the LS side, then you can use tags/types to differentiate and use conditionals when running filters. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 8, 2015, 6:46am UTC](https://discuss.elastic.co/t/how-to-filter-data-from-filebeats-in-logstash/36579/3 "2015-12-08T06:46:45Z")
> It's going to be better to have Filebeat send the files to different ports on the LS side, then you can use tags/types to differentiate and use conditionals when running filters. Why not set [`document_type`](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#_document_type) in the Filebeat configuration and have Filebeat send events with the correct `type` field from the get-go? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 8, 2015, 9:56pm UTC](https://discuss.elastic.co/t/how-to-filter-data-from-filebeats-in-logstash/36579/4 "2015-12-08T21:56:29Z")
Good point 🙂 ---
**Author:** ![msmolyak](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@msmolyak](https://discuss.elastic.co/u/msmolyak)\ **Post date:** [December 8, 2015, 10:11pm UTC](https://discuss.elastic.co/t/how-to-filter-data-from-filebeats-in-logstash/36579/5 "2015-12-08T22:11:50Z")
Thank you for your suggestions. I would like to better understand them. warkolm proposed to run LogStash on multiple ports and configure FileBeat to send each log type to its own port. This sounds like a complicated solution (running multiple processes instead of one) to a simple , or at least, common, problem. magnusbaeck's suggestion was to set document type in FileBeat. How do I use this document\_type in LogStash to filter based on it? Are there examples demonstrating the use of document\_type in LogStash? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 9, 2015, 7:24am UTC](https://discuss.elastic.co/t/how-to-filter-data-from-filebeats-in-logstash/36579/6 "2015-12-09T07:24:57Z")
> Are there examples demonstrating the use of document\_type in LogStash? There's lots of documentation on how to do conditional filtering: [Accessing event data and fields | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) (But note that the field on the Logstash side won't be called `document_type`.) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:19am UTC](https://discuss.elastic.co/t/how-to-filter-data-from-filebeats-in-logstash/36579/7 "2017-07-06T05:19:25Z")