# Logstash Input - beats and azureblob

**URL:** <https://discuss.elastic.co/t/logstash-input-beats-and-azureblob/121866>\
**Category:** Logstash\
**Created:** [February 28, 2018, 2:14pm UTC](https://discuss.elastic.co/t/logstash-input-beats-and-azureblob/121866 "2018-02-28T14:14:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![charan.gandra](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\
**Post date:** [February 28, 2018, 2:14pm UTC](https://discuss.elastic.co/t/logstash-input-beats-and-azureblob/121866/1 "2018-02-28T14:14:53Z")

</div>

Hi,

I am using Filebeat to send the log files from remote host to logstash and also trying to grab NSG flow logs from Azure using logstash plugin.

Here is my input.conf, how can I parse these two individual inputs separately and how do I index them as well? Can someone please give me an example. I wold like to index them separately based on the input.

input {  
beats {  
port =\> 5044  
client\_inactivity\_timeout =\> 599  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
azureblob  
{  
storage\_account\_name =\> "mystorageaccount"  
storage\_access\_key =\> "VGhpcyBpcyBhIGZha2Uga2V5Lg=="  
container =\> "insights-logs-networksecuritygroupflowevent"  
codec =\> "json"  
file\_head\_bytes =\> 12  
file\_tail\_bytes =\> 2  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 28, 2018, 2:23pm UTC](https://discuss.elastic.co/t/logstash-input-beats-and-azureblob/121866/2 "2018-02-28T14:23:03Z")

</div>

Use `tags` or `add_field` for each input to update each event coming from that input. Then you can use conditionals in your filter and output sections to select which events should be sent where.

---

<div class="post-metadata">

**Author:** ![charan.gandra](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\
**Post date:** [February 28, 2018, 2:27pm UTC](https://discuss.elastic.co/t/logstash-input-beats-and-azureblob/121866/3 "2018-02-28T14:27:22Z")

</div>

Thanks for the quick reply, do you have an example syntax?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2018, 2:27pm UTC](https://discuss.elastic.co/t/logstash-input-beats-and-azureblob/121866/4 "2018-03-28T14:27:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.