# Logstash and/or Kibana config wrong

**URL:** https://discuss.elastic.co/t/logstash-and-or-kibana-config-wrong/333317
**Category:** Logstash
**Created:** [May 12, 2023, 2:58pm UTC](https://discuss.elastic.co/t/logstash-and-or-kibana-config-wrong/333317 "2023-05-12T14:58:59Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![mariolanno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mariolanno/32/118963_2.png) [@mariolanno](https://discuss.elastic.co/u/mariolanno)
#### Post date: [May 12, 2023, 2:58pm UTC](https://discuss.elastic.co/t/logstash-and-or-kibana-config-wrong/333317/1 "2023-05-12T14:58:59Z")

</div>

Hi,

I cannot understand why I create two indexes on logstash to grab syslogs from two devices and then send to EL.

```auto
input {
  udp {
    host => "192.168.0.73"
    port => "5515"
  }

}

filter {}

output {
        elasticsearch {
                hosts => ["http://127.0.0.1:9200"]
                index => "vngaf-test-eu-%{+YYYY.MM.dd}"
        }
}

```

```auto
input {
  tcp {
    host => "192.168.0.73"
    port => "5514"
  }

}

filter {}

output {
        elasticsearch {
                hosts => ["http://127.0.0.1:9200"]
                index => "logstash-test-%{+YYYY.MM.dd}"
        }
}

```

Than on Kibana WEB UI -\> Stack Management -\> Kibana Index Pattern , I create an index pattern called like in the indexes of the files.  
So, I think that the device that send logs on port tcp 5514 writes on the index "logstash-test-" and the device that send logs on udp 5515 writes on "vngaf-test-eu".

Instead, all two devices write on all two indexes.  
Could I know why?  
What I wrong in the configuration?

Thanks

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 13, 2023, 4:20am UTC](https://discuss.elastic.co/t/logstash-and-or-kibana-config-wrong/333317/2 "2023-05-13T04:20:58Z")

</div>

Because logstash Concatenates all the .conf files in a single directory... This is a very common mistake and misunderstanding.

So every event is going to both those outputs.

You need to use the pipelines.yml and name each of those pipelines separately.

> **[Multiple Pipelines | Logstash Reference \[8.7\] | Elastic](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html)**

---

<div class="post-metadata">

### Author: ![mariolanno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mariolanno/32/118963_2.png) [@mariolanno](https://discuss.elastic.co/u/mariolanno)
#### Post date: [May 15, 2023, 9:56am UTC](https://discuss.elastic.co/t/logstash-and-or-kibana-config-wrong/333317/3 "2023-05-15T09:56:21Z")

</div>

Hello and thanks for your answer

I added these lines in the pipelines.yml but the result not changed.

```auto
# Custom Pipelines

- pipeline.id: cisco-pipeline_1
  path.config: "/etc/logstash/conf.d/cisco.conf"

- pipeline.id: vngaf_pipeline_2
  path.config: ""/etc/logstash/conf.d/vngaf.cfg"

```

Where is wrong?

Thanks

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 15, 2023, 9:50pm UTC](https://discuss.elastic.co/t/logstash-and-or-kibana-config-wrong/333317/4 "2023-05-15T21:50:26Z")

</div>

Are the events being sent to both ports?

Put a tag on the input and see if you see it on every event

```auto
input {
  udp {
    host => "192.168.0.73"
    port => "5515"
    tag => "udp"
  }

```

Same for the other...

Also would help if you showed the outputs. What are you seeing in discover??

How starting Logstash?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2023, 9:50pm UTC](https://discuss.elastic.co/t/logstash-and-or-kibana-config-wrong/333317/5 "2023-06-12T21:50:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.