# Logstash only working for One filter while for other its not

**URL:** <https://discuss.elastic.co/t/logstash-only-working-for-one-filter-while-for-other-its-not/188089>\
**Category:** Logstash\
**Created:** [June 28, 2019, 4:23pm UTC](https://discuss.elastic.co/t/logstash-only-working-for-one-filter-while-for-other-its-not/188089 "2019-06-28T16:23:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karn\_Gusain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karn_gusain/32/47419_2.png) [@Karn\_Gusain](https://discuss.elastic.co/u/Karn_Gusain)\
**Post date:** [June 28, 2019, 4:23pm UTC](https://discuss.elastic.co/t/logstash-only-working-for-one-filter-while-for-other-its-not/188089/1 "2019-06-28T16:23:50Z")

</div>

I have below config almost running for 1 year and suddenly i got some open file issues on one of the cluster which i fixed after setting on the limits.conf in linux.

I have below logstash pipeline which is working fine of for the `type => "apic_logs"` while it not shiping the logs for `type => "noi-syslog"`.

I dont see any errors on the logstash and elasticsearch nodes.

```
# cat logstash-syslog.conf
input {
  file {
    path => ["/scratch/rsyslog/*/messages.log"]
    start_position => beginning
    sincedb_path => "/scratch/registry-1"
    #sincedb_path => "/dev/null"
    max_open_files => 64000
    type => "noi-syslog"
  }
  file {
    path => ["/scratch/rsyslog_CISCO/*/network.log"]
    start_position => beginning
    #sincedb_path => "/dev/null"
    sincedb_path => "/scratch/registry-2"
    max_open_files => 64000
    type => "apic_logs"
  }
}

filter {
  if [type] == "noi-syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      remove_field => ["host", "path"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
 }
 if "_grokparsefailure" in [tags] {
         drop { }
 }
}
  if [type] == "apic_logs" {
    grok {
      match => { "message" => "%{CISCOTIMESTAMP:syslog_timestamp} %{CISCOTIMESTAMP} %{SYSLOGHOST:syslog_hostname} (?<prog>[\w._/%-]+) %{SYSLOG5424SD:fault_code}%{SYSLOG5424SD:fault_state}%{SYSLOG5424SD:crit_info}%{SYSLOG5424SD:log_severity}%{SYSLOG5424SD:log_info} %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      remove_field => ["host", "path"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
  }
 }
}
output {
        if [type] == "noi-syslog" {
        elasticsearch {
                hosts => "host-elk3:9200"
                manage_template => false
                index => "noi-syslog-%{+YYYY.MM.dd}"
                document_type => "messages"
  }
# stdout{}
 }
}

output {
        if [type] == "apic_logs" {
        elasticsearch {
                hosts => "host-elk2:9200"
                manage_template => false
                index => "apic_logs-%{+YYYY.MM.dd}"
                document_type => "messages"
  }
 }
}

```

Please advise any clue or reference in this case.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 26, 2019, 4:24pm UTC](https://discuss.elastic.co/t/logstash-only-working-for-one-filter-while-for-other-its-not/188089/2 "2019-07-26T16:24:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.