Logstash is not connecting on muliple port for different beats

Elastic Stack Logstash
1

I have 3 server with beat service installed , passing the logs to logstash on different ports 5044,5045,4046

with different index .but all indexes have the same data .

2

input {
beats {
port => 5045
}
}
filter
{
xml
{
source => "message"
target => "doc"
}
}
output
{
elasticsearch
{
codec => json
hosts => ["10.100.76.90:9200"]
# index => "aimlogs"
index => "zic_uat-%{+yyyy.MM.dd}"
document_type => "vdf_xml"
}
stdout {}
}
~

3

Thanks in advance for help

4

I have 3 server with beat service installed , passing the logs to logstash on different ports 5044,5045,4046

What's the point of using different ports?

with different index .but all indexes have the same data .

That's because you're running all configuration files in the same Logstash pipeline. Logstash will concatenate the configuration files so that all filters and outputs apply to all events from all inputs. You can use conditionals to selectively apply filters and outputs. This is an extremely common question here and has been covered many times before.

5

Can you please share any example for source ip rule ?

6

The documentation contains many examples of conditionals: https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals

If you want a specific example you must ask a more specific question than "source ip rule".

7

Thanks

Can you please share the syntax for nested if ,

input {
beats {
port => 5044
}
}
output {
if "json" in [tags] {
elasticsearch {
hosts => "10.11.19.133:9200"
index => "first_indexer"
}
}else if "new" in [tags] {
elasticsearch {
hosts => "10.11.19.133:9200"
index => "second_indexer"
}
else {
elasticsearch {
hosts => "10.11.19.133:9200"
index => "new"

    }
}

}
}

Is this corect ?

8

That syntax is okay, but since I don't know what you want to accomplish I can't tell whether it'll do what you expect.

9

Let me explain you here what I want .I have 3 filebeat location and I have specified tags in every filebeat now i want difffrent index for each filebeat using the tags.
Is it possible ?

10

I would use a custom field instead of tags but either way works.

11

Thanks a alot for help

any example for custom filed with condition

12

The documentation I linked to contains lots of examples of how the compare field values.

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.