# Logstash Forwarder on 2 machines

**URL:** <https://discuss.elastic.co/t/logstash-forwarder-on-2-machines/32545>\
**Category:** Logstash\
**Created:** [October 20, 2015, 3:18am UTC](https://discuss.elastic.co/t/logstash-forwarder-on-2-machines/32545 "2015-10-20T03:18:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tatushar3](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tatushar3](https://discuss.elastic.co/u/tatushar3)\
**Post date:** [October 20, 2015, 3:18am UTC](https://discuss.elastic.co/t/logstash-forwarder-on-2-machines/32545/1 "2015-10-20T03:18:47Z")

</div>

ogstash forwarder is installed on two machines and both are shipping logs to a single machine where logstash is installed.How do I distinguish between the logs of two machines

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 20, 2015, 5:59am UTC](https://discuss.elastic.co/t/logstash-forwarder-on-2-machines/32545/2 "2015-10-20T05:59:56Z")

</div>

Are you sure there isn't already a field (`client` or `host` IIRC) containing the hostname of the originating host?

---

<div class="post-metadata">

**Author:** ![tatushar3](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tatushar3](https://discuss.elastic.co/u/tatushar3)\
**Post date:** [October 20, 2015, 6:39am UTC](https://discuss.elastic.co/t/logstash-forwarder-on-2-machines/32545/3 "2015-10-20T06:39:28Z")

</div>

yes there are but when i use if[host]=="host name of machine where forwarder is installed" logstash does not parse the logs it is stuck. On cmd i get Logstash start up completed but no further processing of logs is there.

But the type field attached in forwarder.conf seems to work now.Don't know why it was not working yesterday

I have one more query.Once logstash parses the logs and if I restart it will not parse the same log again. Either I have to rename it or I have to modify my logs somehow.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 20, 2015, 6:46am UTC](https://discuss.elastic.co/t/logstash-forwarder-on-2-machines/32545/4 "2015-10-20T06:46:32Z")

</div>

> I have one more query.Once logstash parses the logs and if I restart it will not parse the same log again. Either I have to rename it or I have to modify my logs somehow.

Yes, this is by design. You wouldn't want all your logs to be parsed again just because you restarted Logstash, would you? Please read the [file input documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html) and the discussion forum archives about sincedb.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:26am UTC](https://discuss.elastic.co/t/logstash-forwarder-on-2-machines/32545/5 "2017-07-06T05:26:06Z")

</div>

Closed on July 6, 2017, 5:26am UTC