# Logstash/ElasticSearch mixing data across indexes

**URL:** https://discuss.elastic.co/t/logstash-elasticsearch-mixing-data-across-indexes/129934
**Category:** Logstash
**Created:** [April 28, 2018, 10:41pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-mixing-data-across-indexes/129934 "2018-04-28T22:41:00Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![enigy](https://avatars.discourse-cdn.com/v4/letter/e/13edae/32.png) [@enigy](https://discuss.elastic.co/u/enigy)
#### Post date: [April 28, 2018, 10:41pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-mixing-data-across-indexes/129934/1 "2018-04-28T22:41:00Z")

</div>

Hello everyone!  
I'm a fairly new user to ELK. I've been attempting to setup a single node server to receive two syslog streams in my home lab. I've run into a situation I cannot find a resolution to. Simply put, when I put both of my logstash conf files into logstash, the data streams appear to become mixed in with each other, even though the two are using totally different indexes. They are using different ports as well. So I'm really perplexed why data for the second logstash conf starts appearing in the first logstash conf index. Any pointers?

First logstash conf:  
[https://pastebin.com/WS2yqL1X](https://pastebin.com/WS2yqL1X)

Second logstash conf:  
[https://pastebin.com/LVbac7YC](https://pastebin.com/LVbac7YC)

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 29, 2018, 7:21am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-mixing-data-across-indexes/129934/2 "2018-04-29T07:21:35Z")

</div>

Configuration files aren't independent; they're merged and all events from all inputs will reach all filters and outputs unless you use conditionals. You might want to use the multi-pipeline feature in Logstash 6.

This is an extremely common misconception and you should be able to find dozens of old threads discussing this in further detail.

---

<div class="post-metadata">

### Author: ![enigy](https://avatars.discourse-cdn.com/v4/letter/e/13edae/32.png) [@enigy](https://discuss.elastic.co/u/enigy)
#### Post date: [April 29, 2018, 11:39am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-mixing-data-across-indexes/129934/3 "2018-04-29T11:39:21Z")

</div>

Ah, ok. I did have that misconception. thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2018, 11:39am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-mixing-data-across-indexes/129934/4 "2018-05-27T11:39:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
