# Logstash ignore the port defined in pipeline
**URL:** https://discuss.elastic.co/t/logstash-ignore-the-port-defined-in-pipeline/94505
**Category:** Logstash
**Created:** [July 25, 2017, 3:33pm UTC](https://discuss.elastic.co/t/logstash-ignore-the-port-defined-in-pipeline/94505 "2017-07-25T15:33:21Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@camarar](https://discuss.elastic.co/u/camarar)
#### Post date: [July 25, 2017, 3:33pm UTC](https://discuss.elastic.co/t/logstash-ignore-the-port-defined-in-pipeline/94505/1 "2017-07-25T15:33:21Z")
Dear,
I would like receive help to understand a behavior...
My infrastructure is Filebeat -\> Logstash -\> Elasticsearch -\> Kibana
Filebeat:
We have many server send documents to Logstash using differents pipelines and specific ports.
Logstash:
We have 5 pipelines with differents ports.
In Logstash we need to use a IF by [TYPE] in Filter and Output blocks because without these IF all pipelines receive all documents sent by filebeat even using differents ports.
Logstash version is 5.1.2.
Exemple for Logstash and Filebeat configuration:
Logstash:
input {
beats {
port =\> "5005"
}
}
filter {
if [type] == "log\_prod" {
json {
source =\> "message"
remove\_field =\> ["host", "beat", "message", "tags", "source", "input\_type"]
}
}
date {
timezone =\> "America/Sao\_Paulo"
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
output {
if [type] == "log\_prod" {
elasticsearch {
hosts =\> ["server1:9200", "server2:9200"]
index=\> "index-%{+YYYY.MM.dd}"
}
}
}
Filebeat:
filebeat.prospectors:
- input\_type: log
paths:
- /var/log/kibana\_log/kibana.log
document\_type: log\_prod
scan\_frequency: 30s
output:
logstash:
hosts: ["server\_logstash:5005"]
logging:
to\_syslog: false
to\_files: true
files:
path: /var/log/filebeat
name: filebeat.log
keepfiles: 5
level: info
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 26, 2017, 7:59am UTC](https://discuss.elastic.co/t/logstash-ignore-the-port-defined-in-pipeline/94505/3 "2017-07-26T07:59:55Z")
What's your question?
---
### Author:  [@camarar](https://discuss.elastic.co/u/camarar)
#### Post date: [July 26, 2017, 1:08pm UTC](https://discuss.elastic.co/t/logstash-ignore-the-port-defined-in-pipeline/94505/4 "2017-07-26T13:08:12Z")
Is normal this behavior ignoring the port defined in input block?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 26, 2017, 8:37pm UTC](https://discuss.elastic.co/t/logstash-ignore-the-port-defined-in-pipeline/94505/5 "2017-07-26T20:37:26Z")
if i understood your question, It is normal behavior.
Logstash only has one pipeline, you can have multiple .conf files in the conf.d directory, but when logstash is started it will concatenated all the files in one file.
For example, if you have two servers running filebeat, each of one sending to a different port, like 5001 and 5002, you will need to start two beats listeners in logstash.
```auto
input {
beats {
port => "5001"
}
beats {
port => "5002"
}
}
```
It will work, but if you need to send the different inputs to different indices, you will need to filter by type in the filter block or in the output block.
Without conditional statements in the filter and output blocks Logstash will not differentiate the inputs based on its source.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 23, 2017, 8:37pm UTC](https://discuss.elastic.co/t/logstash-ignore-the-port-defined-in-pipeline/94505/6 "2017-08-23T20:37:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.