# How to recognize and separate different syslogs

**URL:** <https://discuss.elastic.co/t/how-to-recognize-and-separate-different-syslogs/148189>\
**Category:** Logstash\
**Created:** [September 11, 2018, 5:19pm UTC](https://discuss.elastic.co/t/how-to-recognize-and-separate-different-syslogs/148189 "2018-09-11T17:19:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![annk](https://avatars.discourse-cdn.com/v4/letter/a/c68b51/32.png) [@annk](https://discuss.elastic.co/u/annk)\
**Post date:** [September 11, 2018, 5:19pm UTC](https://discuss.elastic.co/t/how-to-recognize-and-separate-different-syslogs/148189/1 "2018-09-11T17:19:34Z")

</div>

Hi,

I have couple of applications sending logs on to logstash on same port using rsyslog.  
Is it possible to identify them on logstash syslog input using $InputFileTag or any other tags that I can configure on rsyslog configs ?

example

ceph-rsyslog.conf

$InputFileName /var/log/ceph/ceph-osd.log  
$InputFileTag cephlog  
$InputRunFileMonitor  
$InputFileFacility local0

ceph-logstash.conf

input {  
syslog {  
host =\> "10.1.1.2"  
port =\> 1544  
if [InputFileTag] =~ "cephlog"{  
type =\> "ceph"  
}  
}  
}  
filter {  
if [type] =~ "ceph" {  
mutate {  
add\_field =\> { "environment" =\> "lab" }  
}  
}  
}

any other way of doing it ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 17, 2018, 4:45pm UTC](https://discuss.elastic.co/t/how-to-recognize-and-separate-different-syslogs/148189/2 "2018-09-17T16:45:18Z")

</div>

What happens with the $InputFileTag setting? How (if at all) is that value included in the payload sent over the wire to Logstash? I suggest you use a `stdout { codec => rubydebug }` output to dump the raw event received by Logstash. Once we know what's available we can talk about how to use that information.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2018, 4:45pm UTC](https://discuss.elastic.co/t/how-to-recognize-and-separate-different-syslogs/148189/3 "2018-10-15T16:45:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.