# Logstash is not connecting on muliple port for different beats **URL:** \ **Category:** Logstash\ **Created:** [August 28, 2018, 2:45pm UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379 "2018-08-28T14:45:49Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Nirpendra\_Kumar](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nirpendra\_Kumar](https://discuss.elastic.co/u/Nirpendra_Kumar)\ **Post date:** [August 28, 2018, 2:45pm UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/1 "2018-08-28T14:45:49Z")
I have 3 server with beat service installed , passing the logs to logstash on different ports 5044,5045,4046 with different index .but all indexes have the same data . ---
**Author:** ![Nirpendra\_Kumar](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nirpendra\_Kumar](https://discuss.elastic.co/u/Nirpendra_Kumar)\ **Post date:** [August 28, 2018, 2:46pm UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/2 "2018-08-28T14:46:18Z")
input { beats { port =\> 5045 } } filter { xml { source =\> "message" target =\> "doc" } } output { elasticsearch { codec =\> json hosts =\> ["10.100.76.90:9200"] # index =\> "aimlogs" index =\> "zic\_uat-%{+yyyy.MM.dd}" document\_type =\> "vdf\_xml" } stdout {} } ~ ---
**Author:** ![Nirpendra\_Kumar](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nirpendra\_Kumar](https://discuss.elastic.co/u/Nirpendra_Kumar)\ **Post date:** [August 28, 2018, 2:46pm UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/3 "2018-08-28T14:46:44Z")
Thanks in advance for help ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 28, 2018, 6:41pm UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/4 "2018-08-28T18:41:19Z")
> I have 3 server with beat service installed , passing the logs to logstash on different ports 5044,5045,4046 What's the point of using different ports? > with different index .but all indexes have the same data . That's because you're running all configuration files in the same Logstash pipeline. Logstash will concatenate the configuration files so that all filters and outputs apply to all events from all inputs. You can use conditionals to selectively apply filters and outputs. This is an extremely common question here and has been covered many times before. ---
**Author:** ![Nirpendra\_Kumar](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nirpendra\_Kumar](https://discuss.elastic.co/u/Nirpendra_Kumar)\ **Post date:** [August 29, 2018, 9:41am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/5 "2018-08-29T09:41:49Z")
> [@magnusbaeck](#): > > en covered many times before. Can you please share any example for source ip rule ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 29, 2018, 11:28am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/6 "2018-08-29T11:28:03Z")
The documentation contains many examples of conditionals: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) If you want a specific example you must ask a more specific question than "source ip rule". ---
**Author:** ![Nirpendra\_Kumar](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nirpendra\_Kumar](https://discuss.elastic.co/u/Nirpendra_Kumar)\ **Post date:** [August 30, 2018, 4:35pm UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/7 "2018-08-30T16:35:15Z")
Thanks Can you please share the syntax for nested if , input { beats { port =\> 5044 } } output { if "json" in [tags] { elasticsearch { hosts =\> "10.11.19.133:9200" index =\> "first\_indexer" } }else if "new" in [tags] { elasticsearch { hosts =\> "10.11.19.133:9200" index =\> "second\_indexer" } else { elasticsearch { hosts =\> "10.11.19.133:9200" index =\> "new" ``` } } ``` } } Is this corect ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 31, 2018, 7:29am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/8 "2018-08-31T07:29:23Z")
That syntax is okay, but since I don't know what you want to accomplish I can't tell whether it'll do what you expect. ---
**Author:** ![Nirpendra\_Kumar](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nirpendra\_Kumar](https://discuss.elastic.co/u/Nirpendra_Kumar)\ **Post date:** [August 31, 2018, 8:10am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/9 "2018-08-31T08:10:06Z")
Let me explain you here what I want .I have 3 filebeat location and I have specified tags in every filebeat now i want difffrent index for each filebeat using the tags. Is it possible ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 31, 2018, 9:04am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/10 "2018-08-31T09:04:02Z")
I would use a custom field instead of tags but either way works. ---
**Author:** ![Nirpendra\_Kumar](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nirpendra\_Kumar](https://discuss.elastic.co/u/Nirpendra_Kumar)\ **Post date:** [August 31, 2018, 9:05am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/11 "2018-08-31T09:05:31Z")
Thanks a alot for help any example for custom filed with condition ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 31, 2018, 9:34am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/12 "2018-08-31T09:34:42Z")
The documentation I linked to contains lots of examples of how the compare field values. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 28, 2018, 9:34am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-on-muliple-port-for-different-beats/146379/13 "2018-09-28T09:34:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.