# Logstash configuration: for journalbeat from multiple servers

**URL:** <https://discuss.elastic.co/t/logstash-configuration-for-journalbeat-from-multiple-servers/190475>\
**Category:** Logstash\
**Tags:** beats-module\
**Created:** [July 15, 2019, 9:23am UTC](https://discuss.elastic.co/t/logstash-configuration-for-journalbeat-from-multiple-servers/190475 "2019-07-15T09:23:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![K\_B1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/k_b1/32/48063_2.png) [@K\_B1](https://discuss.elastic.co/u/K_B1)\
**Post date:** [July 15, 2019, 9:23am UTC](https://discuss.elastic.co/t/logstash-configuration-for-journalbeat-from-multiple-servers/190475/1 "2019-07-15T09:23:38Z")

</div>

Hi there, I've been trying to collect logs, using journalbeat from multiple servers onto a single logstash server. I already have winlogbeat on my windows server which is using 5044, hence other servers with journalbeat are on 5045. It throws following error:

> Error: Cannot assign requested address  
> Exception: Java::JavaNet::BindException

here is my logstash conf file. I don't understand how do I differentiate these logs/indices between server1 & server2.  
@magnusbaeck could you please suggest

```
input {

beats {
     port => "5044"
     tags => ["windows-server"]
}
  beats {
     port => "5045"
     tags => ["server1"]
}
  beats {
     port => "5045"
     tags => ["server2"]
}

}

output {

 if "windows-server" in [tags] {
                elasticsearch {
                        hosts => ["ip of elasticsearch:9200"]
                        manage_template => false
                        index => "windowslogs-%{+YYYY.MM.dd}"
                        user => "elastic"
                        password => "password"
                 }
}
    if "server1" in [tags] {
                elasticsearch {
                        hosts => ["ip of elasticsearch:9200"]
                        manage_template => false
                        index => "server1logs-%{+YYYY.MM.dd}"
                        user => "elastic"
                        password => "password"
                 }
}

    if "sever2" in [tags] {
                elasticsearch {
                        hosts => ["ip of elasticsearch:9200"]
                        manage_template => false
                        index => "server2logs-%{+YYYY.MM.dd}"
                        user => "elastic"
                        password => "password"
                 }
}

}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2019, 2:40pm UTC](https://discuss.elastic.co/t/logstash-configuration-for-journalbeat-from-multiple-servers/190475/2 "2019-07-15T14:40:29Z")

</div>

You cannot have two beats inputs listening on the same port (5045). The beats will add fields to the events that identify which host they are coming from.

---

<div class="post-metadata">

**Author:** ![K\_B1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/k_b1/32/48063_2.png) [@K\_B1](https://discuss.elastic.co/u/K_B1)\
**Post date:** [July 15, 2019, 2:53pm UTC](https://discuss.elastic.co/t/logstash-configuration-for-journalbeat-from-multiple-servers/190475/3 "2019-07-15T14:53:54Z")

</div>

Is it possible then to filter by hosts but on the same port? I might need to add more servers to this configuration. Or (Directing to different ports would only help?) what could be a better solution to this? please suggest.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2019, 3:00pm UTC](https://discuss.elastic.co/t/logstash-configuration-for-journalbeat-from-multiple-servers/190475/4 "2019-07-15T15:00:48Z")

</div>

You could use a different port for each source server and add tags to differentiate them, but there is no need to do that because the beats add fields that differentiate them.

---

<div class="post-metadata">

**Author:** ![K\_B1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/k_b1/32/48063_2.png) [@K\_B1](https://discuss.elastic.co/u/K_B1)\
**Post date:** [July 16, 2019, 6:00am UTC](https://discuss.elastic.co/t/logstash-configuration-for-journalbeat-from-multiple-servers/190475/5 "2019-07-16T06:00:46Z")

</div>

Thanks for your prompt response:🙂  
Could you please give an example for my better understanding.

In journalbeat, I've put `_SYSLOG_IDENTIFIER` in include matches section

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2019, 6:01am UTC](https://discuss.elastic.co/t/logstash-configuration-for-journalbeat-from-multiple-servers/190475/6 "2019-08-13T06:01:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.