# How to receive logs from multiple filebeats running on different machine(ec2) to one logstash instance?

**URL:** <https://discuss.elastic.co/t/how-to-receive-logs-from-multiple-filebeats-running-on-different-machine-ec2-to-one-logstash-instance/306314>\
**Category:** Logstash\
**Created:** [June 3, 2022, 9:42am UTC](https://discuss.elastic.co/t/how-to-receive-logs-from-multiple-filebeats-running-on-different-machine-ec2-to-one-logstash-instance/306314 "2022-06-03T09:42:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Krishna\_Prasad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishna_prasad/32/106572_2.png) [@Krishna\_Prasad](https://discuss.elastic.co/u/Krishna_Prasad)\
**Post date:** [June 3, 2022, 9:42am UTC](https://discuss.elastic.co/t/how-to-receive-logs-from-multiple-filebeats-running-on-different-machine-ec2-to-one-logstash-instance/306314/1 "2022-06-03T09:42:39Z")

</div>

i have 2 filebeats running on different machine(Ex: A & B) and I have also specified the logstash machine IP in filebeat.yaml

so i have written 2 logstash .conf file .

My conf file looks like this -\>

## A.conf

input{ beat{ port:"" host:"private-ip-m1" } }

## B.conf

input{ beat{ port:"" host:"private-ip-m2" } }

after I run logstash it is unable to connect. it says Error: Cannot assign requested address.

Can anyone tell me is there any other way to this ?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 3, 2022, 12:29pm UTC](https://discuss.elastic.co/t/how-to-receive-logs-from-multiple-filebeats-running-on-different-machine-ec2-to-one-logstash-instance/306314/2 "2022-06-03T12:29:39Z")

</div>

What are the `private-ip-m1` and `private-ip-m2`?

Your error means that one of IP address that yo uset in the `host` option does not exist in the logstash instance.

Also, why are you using two beats input in the same logstash? You can use just one beats input.

You do not need to set `host` option of the `beats` input, remove it and Logstash will listen to the specified port in all available IPs of the instance. If you want to set it, you need to use an available IP in the instance.

---

<div class="post-metadata">

**Author:** ![Krishna\_Prasad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishna_prasad/32/106572_2.png) [@Krishna\_Prasad](https://discuss.elastic.co/u/Krishna_Prasad)\
**Post date:** [June 6, 2022, 4:47am UTC](https://discuss.elastic.co/t/how-to-receive-logs-from-multiple-filebeats-running-on-different-machine-ec2-to-one-logstash-instance/306314/3 "2022-06-06T04:47:26Z")

</div>

`private-ip-m1` and `private-ip-m2` i meant Amazon ec2 instance ip address. i have installed filebeats in these two ec2 instances.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 6, 2022, 5:03am UTC](https://discuss.elastic.co/t/how-to-receive-logs-from-multiple-filebeats-running-on-different-machine-ec2-to-one-logstash-instance/306314/4 "2022-06-06T05:03:40Z")

</div>

You don't put the source metricbeat IPs in the beats input just port 5044.

Then each metricbeat.yml set the `output.logstash` to point to the IP of the logstash.

---

<div class="post-metadata">

**Author:** ![Krishna\_Prasad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishna_prasad/32/106572_2.png) [@Krishna\_Prasad](https://discuss.elastic.co/u/Krishna_Prasad)\
**Post date:** [June 6, 2022, 8:55am UTC](https://discuss.elastic.co/t/how-to-receive-logs-from-multiple-filebeats-running-on-different-machine-ec2-to-one-logstash-instance/306314/5 "2022-06-06T08:55:24Z")

</div>

Actually, I'm getting the logs from those 2 file beats to logstash but all logs are stored in one index but I want to create two different index names for logs coming from those 2 machines. How can I do that?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 4, 2022, 8:55am UTC](https://discuss.elastic.co/t/how-to-receive-logs-from-multiple-filebeats-running-on-different-machine-ec2-to-one-logstash-instance/306314/6 "2022-07-04T08:55:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.