# Log Management for Multiple Application Instances

**URL:** <https://discuss.elastic.co/t/log-management-for-multiple-application-instances/214940>\
**Category:** Logstash\
**Created:** [January 14, 2020, 7:36am UTC](https://discuss.elastic.co/t/log-management-for-multiple-application-instances/214940 "2020-01-14T07:36:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![amin224](https://avatars.discourse-cdn.com/v4/letter/a/6bbea6/32.png) [@amin224](https://discuss.elastic.co/u/amin224)\
**Post date:** [January 14, 2020, 7:36am UTC](https://discuss.elastic.co/t/log-management-for-multiple-application-instances/214940/1 "2020-01-14T07:36:23Z")

</div>

Hello, sorry if this has been asked before but i am new to ELK stack and did not find an answer for my question. If i have an application that is running multiple instances for example instance1, instance2, instance3 and i want to do log management for this application using ELK stack. I am using Logstash which takes the logs from a logging.file of the application and displays it on Kibana. My issue is how can i differentiate between the logs of all 3 instances so i know which one sends logs in case one of them is not functioning properly. I tried using spring cloud sleuth but the issue is that i have different traceIDs and i dont want to search in all instances to find the traceID that belongs to the instance. Is there a way to include the IP address and port in the logstash configuration file?  
This is a sample of the log requests

```
2020-01-13 23:19:50.078 INFO [microservice1,81bda65d4c16a2d0,81bda65d4c16a2d0,false] 8278 --- [nio-8001-exec-1] c.s.m.c.Microservice1Controller : This is an INFO log
2020-01-13 23:19:50.078 ERROR [microservice1,81bda65d4c16a2d0,81bda65d4c16a2d0,false] 8278 --- [nio-8001-exec-1] c.s.m.c.Microservice1Controller : This is an ERROR log

```

This is the log output information present in kibana

```
|@timestamp| : Jan 13, 2020 @ 06:38:15.986|
|@version : 1|
|_id : SARXn28B-hgxozi_UC3u|
|_index : logstash-2020.01.03-000001|
|_score : - |
|_type : _doc|
|host : ubuntu|
|message : 2020-01-13 06:36:39.863 INFO [microservice1,064d4100c385c9f5,064d4100c385c9f5,false] 5791 --- [http-nio-8001-exec-2] c.s.m.c.Microservice1Controller : This is an INFO log|
|path : /home/user/microservice1logging/microservice1.log|
|type : java|

```

Picture of my Kibana UI with the available fields

 ![fields](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e15159bcc1b2f6579637f6315c5446c9aadb3cb7.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 14, 2020, 2:41pm UTC](https://discuss.elastic.co/t/log-management-for-multiple-application-instances/214940/2 "2020-01-14T14:41:59Z")

</div>

What logstash input are you using to consume the files?

---

<div class="post-metadata">

**Author:** ![amin224](https://avatars.discourse-cdn.com/v4/letter/a/6bbea6/32.png) [@amin224](https://discuss.elastic.co/u/amin224)\
**Post date:** [January 15, 2020, 3:44pm UTC](https://discuss.elastic.co/t/log-management-for-multiple-application-instances/214940/4 "2020-01-15T15:44:45Z")

</div>

Never mind i fixed my issue by adding fields using mutate filter plugin. Sorry i am new to elastic stack and trying to learn more features. Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2020, 3:44pm UTC](https://discuss.elastic.co/t/log-management-for-multiple-application-instances/214940/5 "2020-02-12T15:44:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.