Logs are ignoring input section in config files

Hi,

I have a simple setup for capturing logs though HTTP and TCP. I've created 2 conf files at /etc/logstash/conf.d/ (see below) but logs sent though HTTP are also being passed through the TCP pipeline and vise versa. For example when I send a log through TCP it ends up both in http-logger-* index and in tcp-logger-*.. it makes no sense to me :frowning:

http_logger.conf

input {
  http {
    port => 9884
  }
}
filter {
    grok {
      match => ["[headers][request_path]", "\/(?<component>[\w-]*)(?:\/)?(?<env>[\w-]*)(?:\/)?"]
    }
}
output {
    amazon_es {
        hosts => ['XXXXX']
        region => 'us-west-2'
        aws_access_key_id => 'XXXXX'
        aws_secret_access_key => 'XXXXX'
        index => 'http-logger-%{+YYYY.MM.dd}'
    }
    stdout { codec => rubydebug }
}

tcp_logger.conf

input {
  tcp {
    port => 9885
    codec => json
  }
}
filter {

}
output {
    amazon_es {
        hosts => ['XXXXX']
        region => 'us-west-2'
        aws_access_key_id => 'XXXXX'
        aws_secret_access_key => 'XXXXX'
        index => 'tcp-logger-%{+YYYY.MM.dd}'
    }
    stdout { codec => rubydebug }
}

Any ideas on what am I missing? Thank you

Originally, each Logstash process only had one pipeline. Since pipelines could get pretty complex, users were able to break their configurations up into multiple files, which would be reassembled into a single pipeline when Logstash started up.

Then, Multiple Pipelines were introduced; you'll need to use pipelines.yml to opt into the multi-pipeline experience.

1 Like

That works perfectly, thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.