# How to handle Multiple Config files in logstash

**URL:** https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520
**Category:** Logstash
**Created:** [November 14, 2017, 9:13am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520 "2017-11-14T09:13:09Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)
#### Post date: [November 14, 2017, 9:13am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/1 "2017-11-14T09:13:09Z")

</div>

Hi All

I am trying to load two different configurations (different data filters for each ) at a time on single command line

I tried the below :

from command line ( sudo bin/logstash -f /etc/logstash/conf.d/logstash.conf1 -f /etc/logstash/conf.d/logstash.conf2)

-f '/etc/logstash/conf.d/{logstash.conf1,logstash.conf2}'

It posts the data for logstash.conf2 only.

how can we add tags in input filed

for eg :

input {  
file {  
path =\> "\var\log\xs.log"  
tags =\> ["xs"]  
start\_position =\> "beginning"

path =\> "\var\log\snmp.log"  
tags =\> ["snmp"]  
start\_position =\> "beginning"  
}  
}

Please help

Thanks  
Arun

---

<div class="post-metadata">

### Author: ![nugusbayevkk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nugusbayevkk/32/126683_2.png) [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)
#### Post date: [November 14, 2017, 9:30am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/2 "2017-11-14T09:30:49Z")

</div>

hi, you can do as follow:  
input {  
file {  
type =\> "file1"  
...  
}  
file {  
type\> "file2"  
....  
}  
}  
filter {  
if [type] == "file1" {  
.. do something  
}  
if [type] == "file2" {  
.. do something  
}  
}

output {  
if [type] == "file1" {  
write to elk or someting else ..  
}  
}

---

<div class="post-metadata">

### Author: ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)
#### Post date: [November 14, 2017, 9:44am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/3 "2017-11-14T09:44:13Z")

</div>

Thanks Kanagat I ll check it

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 14, 2017, 9:57am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/4 "2017-11-14T09:57:17Z")

</div>

In Logstash 6.0 you will be able to simplify this type of configuration as you can [define multiple separate pipelines that can run side-by-side in a single Logstash instance](https://www.elastic.co/blog/logstash-multiple-pipelines).

---

<div class="post-metadata">

### Author: ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)
#### Post date: [November 14, 2017, 10:01am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/5 "2017-11-14T10:01:14Z")

</div>

```
# apache.cfg
input { beats { port => 3444 } }
filter { dissect { ... } }
output { elasticsearch { ... } }

```

here how can I give multiple log files ? can you pl help

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 14, 2017, 10:12am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/6 "2017-11-14T10:12:35Z")

</div>

Your Logstash doesn't read log files at all so the question of how to make it read multiple log files doesn't make sense. If you're using Filebeat to read your log files then that's the configuration you need to adjust.

---

<div class="post-metadata">

### Author: ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)
#### Post date: [November 14, 2017, 10:31am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/7 "2017-11-14T10:31:53Z")

</div>

here I m trying to input the log file directly to logstash

input{  
file {  
path =\> "/home/arun/xs.txt"  
tags =\> ["xs"]  
start\_position =\> beginning  
......  
}  
}  
file {  
path =\> "/home/arun/snmp.log"  
tags =\> ["snmp"]  
start\_position =\> beginning  
......  
}  
}

tried the above and got worked Is there any alternate / best way to do the same ?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 14, 2017, 11:02am UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/8 "2017-11-14T11:02:44Z")

</div>

Well, that's a completely different configuration. But yes, that's a good way of reading multiple log files. If they shouldn't be tagged differently you could list multiple filenames or patterns in the same file input.

---

<div class="post-metadata">

### Author: ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)
#### Post date: [November 14, 2017, 12:18pm UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/9 "2017-11-14T12:18:39Z")

</div>

thank you 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 12, 2017, 12:18pm UTC](https://discuss.elastic.co/t/how-to-handle-multiple-config-files-in-logstash/107520/10 "2017-12-12T12:18:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
