How to run multiple configuration file as a service

[vinay_garg]

Hi All,

I'm using Logstash 5.5.2. I have installed logstash using rpm.

I'm trying to run multiple conf file logstash-a.conf, logstash-b.conf, logstash-c.conf parallely in logstash as a service. I have kept all conf file in /etc/logstash/conf.d/.

cat lostash-a.conf
input{
beats{
hosts => "0.0.0.0",
port => 5044
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "a-%{+YYYY.MM.dd}"
}
}
All the configuration are same except beat port and index name. beat port and Index name is different in all conf file.

When i've started service, only one conf file is executed at once time. I'm not able to run all conf file parallel.

Can anyone suggest how can i run?
I'll be very thankful to you.

[magnusbaeck (Magnus Bäck)]

When i’ve started service, only one conf file is executed at once time.

Exactly what do you mean by that?

I’m not able to run all conf file parallel.

What's in the rest of the files?

Please be aware that Logstash has a single event pipeline. Unless you use conditionals all events from all inputs in all configuration files will be processed by all filters in all configuration files and then sent to all outputs in all configuration files.

[vinay_garg]

I have also used condition by using (tags => "name") in input and (if "name" in [tags]) in filter & output, but all the index data got mixed.
Can you give me some example how can i use multiple input beat file with different port and output index will be differ for each conf file in single logstash?

[vinay_garg]

Hi,

Thanks for your response.

I've resolve the issue.
In the each filebeat file, i have define document_type = "firstfile"

In the logstash file, i have define type = "firstfile" with each beat input and apply condition if else in fiter & output.