HTTP Plugin port numbers

[rpazhyannur]

I have two scripts using the HTTP plug listening on different ports (log stash is running on centos on an AWS instance)
However, when I post something on one port both scripts are getting the HTTP request.

script 1
input {
http {
host => "0.0.0.0"
port => 31312 # default: 8080
}
}
....

script 2
input {
http {
host => "0.0.0.0"
port => 31311 # default: 8080
}
}

[magnusbaeck (Magnus Bäck)]

What does the rest of your configuration look like? What makes you reach the conclusion that both http inputs are receiving the same HTTP request?

[rpazhyannur]

script 1

input {
http {
host => "0.0.0.0"
port => 31311 # default: 8080
}
}

output {
stdout {
codec => rubydebug
}
elasticsearch{
hosts => "localhost"
index => "iot_collector-1"
}
}

script 2

input {
http {
host => "0.0.0.0"
port => 31312 # default: 8080
}
}

output {
stdout {
codec => rubydebug
}
elasticsearch{
hosts => "localhost"
index => "iot_collector"
}
}

When I use postman to post on port 31311, i get entries both index iot_collector and iot_collector-1. (To be clear, this is not my actual script but I simplified it to debug this problem.)

thanks

Rajesh

[magnusbaeck (Magnus Bäck)]

This is expected. Logstash has a single event pipeline that feeds events from all inputs to all filters and then to all outputs. If you don't like that you need to introduce conditionals to choose which events go where. Putting configuration into different files doesn't matter.

[rpazhyannur]

Thank you for the quick response.
I did notice when I ran the two scripts separately on the command line, I did not have this problem. I had the problem only when I put both scripts in /etc/logstash/conf.d (and I am assuming that in that case this is a single instance)