# Logstash forwarder settings **URL:** \ **Category:** Logstash\ **Created:** [March 6, 2017, 10:42am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478 "2017-03-06T10:42:25Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![emilio](https://avatars.discourse-cdn.com/v4/letter/e/f475e1/32.png) [@emilio](https://discuss.elastic.co/u/emilio)\ **Post date:** [March 6, 2017, 10:42am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/1 "2017-03-06T10:42:25Z")
Dear all, I have a lot of application logs on different hosts. I am going transfer all my application logs into time based index. So, i have couple of questions: 1.How and where i can mark transferring logs that they belong to some application? For example, logs of "A application", "B application", etc. 2.Should me to insert logs in time based index in the same type giving some settings in logstash forwarder or not? 3.Where can i get all possible settings for logstash forwarder and logstash indexer? Thank you in advance ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 6, 2017, 10:59am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/2 "2017-03-06T10:59:55Z")
> How and where i can mark transferring logs that they belong to some application? The `type` field is often used for this, but you can define other fields too. > Should me to insert logs in time based index in the same type giving some settings in logstash forwarder or not? Sorry, I can't parse this sentence. > Where can i get all possible settings for logstash forwarder and logstash indexer? Have you looked at the documentation at [elastic.co](http://elastic.co)? ---
**Author:** ![emilio](https://avatars.discourse-cdn.com/v4/letter/e/f475e1/32.png) [@emilio](https://discuss.elastic.co/u/emilio)\ **Post date:** [March 6, 2017, 11:13am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/3 "2017-03-06T11:13:58Z")
Thanks a lot Magnus. > [@magnusbaeck](#): > > The type field is often used for this, but you can define other fields too. Should me config it in logstash forwarder or in logstash indexer? > [@magnusbaeck](#): > > Sorry, I can't parse this sentence. I mean should me insert logs which belong to different applications to the same "table"-type or not by means some settings in logstash forwarder ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 6, 2017, 11:16am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/4 "2017-03-06T11:16:52Z")
> Should me config it in logstash forwarder or in logstash indexer? Do that as close to the source as possible, i.e. in the forwarder instance of Logstash that collects the data. ---
**Author:** ![emilio](https://avatars.discourse-cdn.com/v4/letter/e/f475e1/32.png) [@emilio](https://discuss.elastic.co/u/emilio)\ **Post date:** [March 6, 2017, 11:34am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/5 "2017-03-06T11:34:47Z")
Thank you very much for quick response, Magnus. Time based index also should be configured in logstash forwarders which are collects data? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 6, 2017, 12:03pm UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/6 "2017-03-06T12:03:58Z")
That's typically done in the indexer instance. ---
**Author:** ![emilio](https://avatars.discourse-cdn.com/v4/letter/e/f475e1/32.png) [@emilio](https://discuss.elastic.co/u/emilio)\ **Post date:** [March 6, 2017, 12:42pm UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/7 "2017-03-06T12:42:28Z")
Dear Magnus, Could you please provide one examples of logstash-forwarder config and one example of logstash-indexer config for my case? Imagine that i have two tomcats on the same host and two applications working on them (A and B). The goal is place logs of applications to time based index in elasticsearch and having properties reffered to applications generated these logs. It will be greatly appreciated and it will be solution of this topic for me. Thank you in advance. ---
**Author:** ![emilio](https://avatars.discourse-cdn.com/v4/letter/e/f475e1/32.png) [@emilio](https://discuss.elastic.co/u/emilio)\ **Post date:** [March 7, 2017, 10:22am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/8 "2017-03-07T10:22:18Z")
Magnus, could you please help me? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 7, 2017, 10:27am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/9 "2017-03-07T10:27:41Z")
I'm afraid I don't have time to write up such detailed examples. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 4, 2017, 10:28am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478/10 "2017-04-04T10:28:00Z")
Closed on April 4, 2017, 10:28am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.