Logstash with multi port nad multi file not work properly

Yes, under a single pipeline, everything is merge. It's by design. Explained here, here and here.

Your logic has sense when is a case - single node, 3-5 nodes etc. The enterprise environment is a little bit different. You have data transformation for FB, HTTP, syslog, jdbc from a single "source" - department inside biiiig company. When 2-5 different persons are working on the ETL integration, one big .conf file could be mess. Also don't forget, LS supports the ruby code, execution files,... That is mess, I mean a really mess, the single file with more than several hundreds lines in the filter section.

1 Like