# How to push two inputs data as a single event(docment) in logstash.ym

**URL:** https://discuss.elastic.co/t/how-to-push-two-inputs-data-as-a-single-event-docment-in-logstash-ym/84274
**Category:** Logstash
**Created:** [May 2, 2017, 1:37pm UTC](https://discuss.elastic.co/t/how-to-push-two-inputs-data-as-a-single-event-docment-in-logstash-ym/84274 "2017-05-02T13:37:05Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![kabali12345](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kabali12345](https://discuss.elastic.co/u/kabali12345)
#### Post date: [May 2, 2017, 1:37pm UTC](https://discuss.elastic.co/t/how-to-push-two-inputs-data-as-a-single-event-docment-in-logstash-ym/84274/1 "2017-05-02T13:37:05Z")

</div>

Hi...all  
How can i push two inputs data as a single event(docment) in logstash.yml  
for example

```auto
input{
    file{
        type => "dummylog"
        path => [/var/log/messages]
    }
  file{
        type => "log"
        path => [/var/log/kernel.logs]
    }

}

output {
   elasticsearch { host => localhost } stdout { } }
}

```

let /var/log/messages has 100 events and  
let /var/log/kernel.logs has 100 events  
and how can i push /var/log/messages first line and /var/log/kernel.logs first line as single event(document) into elasticsearch  
will that possible.....to do?  
thank you

---

<div class="post-metadata">

### Author: ![jkuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkuang/32/72637_2.png) [@jkuang](https://discuss.elastic.co/u/jkuang)
#### Post date: [May 2, 2017, 6:06pm UTC](https://discuss.elastic.co/t/how-to-push-two-inputs-data-as-a-single-event-docment-in-logstash-ym/84274/2 "2017-05-02T18:06:46Z")

</div>

In the output you can specify two if statements and point them to the same index oneEvent.

For example:

```auto

input {
    file {
            type => "technical"
            path => "/home/technical/log"
    }
    file {
            type => "business"
            path => "/home/business/log"
    }
} 
output {
    if [type] == "technical" {
            # output to elasticsearch index oneEvent
    }
    if [type] == "business" {
            # output to elasticsearch index oneEvent
    }

```

---

<div class="post-metadata">

### Author: ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)
#### Post date: [May 3, 2017, 2:48am UTC](https://discuss.elastic.co/t/how-to-push-two-inputs-data-as-a-single-event-docment-in-logstash-ym/84274/3 "2017-05-03T02:48:37Z")

</div>

I used the same way but it didn't worked out. input is not accepting 2 file parameters.

---

<div class="post-metadata">

### Author: ![jkuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkuang/32/72637_2.png) [@jkuang](https://discuss.elastic.co/u/jkuang)
#### Post date: [May 3, 2017, 4:27pm UTC](https://discuss.elastic.co/t/how-to-push-two-inputs-data-as-a-single-event-docment-in-logstash-ym/84274/4 "2017-05-03T16:27:23Z")

</div>

This works for me. See my new example below:

```auto
input {

 file {
sincedb_path => "/tmp/sincedb"
    path => "/tmp/tech.log"
    type => "technical" # a type to identify those logs (will need this later)
    start_position => "beginning"
}

    file {
 sincedb_path => "/tmp/sincedb2"
            type => "business"
            path => "/tmp/bus.log"
start_position => "beginning"
    }
}

output {

            if [type] == "technical" {
            # output to elasticsearch index oneEvent
        elasticsearch {
                index => "hitwo"
                document_type =>"tech"
        }
    }
    if [type] == "business" {
            # output to elasticsearch index oneEvent
   elasticsearch {
                index => "hitwo"
                document_type =>"bus"
    }
}
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2017, 4:30pm UTC](https://discuss.elastic.co/t/how-to-push-two-inputs-data-as-a-single-event-docment-in-logstash-ym/84274/5 "2017-05-31T16:30:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
