# Logs from different ports issue

**URL:** <https://discuss.elastic.co/t/logs-from-different-ports-issue/356763>\
**Category:** Logstash\
**Created:** [April 4, 2024, 11:30am UTC](https://discuss.elastic.co/t/logs-from-different-ports-issue/356763 "2024-04-04T11:30:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tegerei](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tegerei/32/132992_2.png) [@tegerei](https://discuss.elastic.co/u/tegerei)\
**Post date:** [April 4, 2024, 11:30am UTC](https://discuss.elastic.co/t/logs-from-different-ports-issue/356763/1 "2024-04-04T11:30:21Z")

</div>

Hello,

I have the following setup:

- system logs are sent to logstash using filebeat on port 5044,
- Apache logs being sent to logstash (same logstash instance as above) using filebeat on port 5047

I then pull these logs as follows:  
/etc/logstash/conf.d/system.conf

```auto
input {
  beats {
    port => 5044
  }
}
filter {}
output {
elasticsearch {
     hosts => ["https://localhost:9200"]
     cacert => "/etc/logstash/conf.d/es-ca.crt"
     index => "system"
     user => "filebeat"
     password => "password"
     }
   }

```

/etc/logstash/conf.d/apache.conf

```auto
input {
  beats {
    port => 5047
  }
}
filter {}
output {
elasticsearch {
     hosts => ["https://localhost:9200"]
     cacert => "/etc/logstash/conf.d/es-ca.crt"
     index => "apache"
     user => "filebeat"
     password => "password"
     }
   }

```

The issue I have is that, as much as the logs are received, they are mixed. Logs that should be in port 5047 are found on 5044, and vice versa.

How can I ensure logs hitting port 5044 should not also hit 5047?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 4, 2024, 11:43am UTC](https://discuss.elastic.co/t/logs-from-different-ports-issue/356763/2 "2024-04-04T11:43:46Z")

</div>

You need to configure logstash to use [multiple pipelines](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html).

Per default it will merge all config files in the `/etc/logstash/conf.d` path, so you have just **one** config where **all** input will be sent to **all** filters and output, unless you use conditionals.

If the pipelines needs to be separated from each other, then the best approach is to configure multiple pipelines in `pipelines.yml`.

Change your `pipelines.yml` to this one and restart the logstash service.

```auto
- pipeline.id: system
  path.config: "/etc/logstash/conf.d/system.conf"
- pipeline.id: apache
  path.config: "/etc/logstash/conf.d/apache.conf"

```

---

<div class="post-metadata">

**Author:** ![tegerei](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tegerei/32/132992_2.png) [@tegerei](https://discuss.elastic.co/u/tegerei)\
**Post date:** [April 4, 2024, 12:03pm UTC](https://discuss.elastic.co/t/logs-from-different-ports-issue/356763/3 "2024-04-04T12:03:59Z")

</div>

Thanks,

I was using this approach in a different scenario. I will use it when needed.

Regards