Logstash to read from multiple server filebeat

(Sridhar B) #1

Hi All,
below is the file beat I'm configuring in one server with port 5044


- paths:
- /path/to/logs/router-001-yyyymmdd.log
include: "Read from QMANGER:INPUT_IN"
fields: {log_type: input_interface}
- /path/to/logs/router-002-yyyymmdd.log
include: "Write on QMANGER:OUTPUT_OUT"
fields: {log_type: output_interface}

Logstash: config file

input {
beats {
port => 5044
filter {
if [fields][log_type] == "input_interface" {
mutate {
add_field => { "foo" => "var" }
if [fields][log_type] == "output_interface" {
mutate {
add_field => { "foo" => "var" }

the above will work for one server log files, if I want to get logs from another servers.. how should I configure logstash conf file.?

Please help..
Sridhar. B

(Magnus Bäck) #2

Unless you want to filter those log messages differently (or send them to different outputs) you don't have to do anything.

(Sridhar B) #3


yes, in my case I should do the both..

I have to filter them and send them to another ES indies.

Please help..

(Magnus Bäck) #4

See for example https://stackoverflow.com/a/27147688/414355. The topic has also been discussed here many many times before.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.