# Logstash with multiple input and output

**URL:** <https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524>\
**Category:** Logstash\
**Created:** [December 3, 2020, 2:39pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524 "2020-12-03T14:39:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ck\_7](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@ck\_7](https://discuss.elastic.co/u/ck_7)\
**Post date:** [December 3, 2020, 2:39pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524/1 "2020-12-03T14:39:31Z")

</div>

Help me to understand the below logstash config. Trying to configure multiples input and output but index shows only one.

Here my config:  
There is no Error: logstash runs but no index name for the storage. only network logs works

input {  
tcp {  
port =\> 5514  
codec =\> plain  
tags =\> network  
}  
}  
input {  
tcp {  
port =\> 5515  
codec =\> plain  
tags =\> storage  
}  
}  
filter {  
if "network" in [tags] {  
mutate {  
add\_field =\> { "hostname" =\> "%{host}" }  
}  
dns {  
action =\> "replace"  
reverse =\> ["hostname"]  
add\_tag =\> ["dns\_lookup"]  
}  
}  
else if "storage" in [tags] {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}  
output {  
if "network" in [tags] {  
elasticsearch { hosts =\> ["[https://elk-logging.XXXXXX.net:9200](https://elk-logging.XXXXXX.net:9200)"]  
cacert =\> '/etc/logstash/certs/xxxxxxxxxx.crt'  
user =\> "elastic"  
password =\> "XXXXXXXXXX"  
index =\> "network-syslog" }  
stdout { codec =\> rubydebug }  
}  
else if "storage" in [tags] {  
elasticsearch { hosts =\> ["[https://elk-logging.XXXXXXX.net:9200](https://elk-logging.XXXXXXX.net:9200)"]  
cacert =\> '/etc/logstash/certs/xxxxxxxx.crt'  
user =\> "elastic"  
password =\> "XXXXXXXX"  
index =\> "storage-syslog" }  
stdout { codec =\> rubydebug }  
}  
}

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [December 3, 2020, 2:57pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524/2 "2020-12-03T14:57:29Z")

</div>

Think it's just ignoring your second input block. I've never tried to add 2 input blocks and would think that would throw an error. Try below and let me know if it works.

```auto
input {
 tcp {
  port => 5514
  codec => plain
  tags => network
 }
 tcp {
  port => 5515
  codec => plain
  tags => storage
 }
}

```

---

<div class="post-metadata">

**Author:** ![ck\_7](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@ck\_7](https://discuss.elastic.co/u/ck_7)\
**Post date:** [December 3, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524/3 "2020-12-03T15:12:03Z")

</div>

Thanks for the quick reply. That was so fast.  
Modified the config but no use still the same .. Receiving logs from the network but not Storage. ☹

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [December 3, 2020, 3:18pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524/4 "2020-12-03T15:18:13Z")

</div>

Next I'd try to just verify data coming in using something like below.

```auto
input {
 tcp {
  port => 5515
  codec => plain
  tags => storage
 }
}
output {
 stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![ck\_7](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@ck\_7](https://discuss.elastic.co/u/ck_7)\
**Post date:** [December 3, 2020, 3:18pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524/5 "2020-12-03T15:18:56Z")

</div>

Sorry Aaron,  
configured with rsyslog in one VM. logs are redirected to 5515 port with storage. its worked need to check real storage devices.

Thanks for the Quick reply .. You saved my day.

My Storage sending Syslog info using UDP by default. same configured with input with UDP port 5515.

Final input

input {  
tcp {  
port =\> 5514  
codec =\> plain  
tags =\> network  
}  
udp {  
port =\> 5514  
codec =\> plain  
tags =\> network  
}  
tcp {  
port =\> 5515  
codec =\> plain  
tags =\> storage  
}  
udp{  
port =\> 5515  
codec =\> plain  
tags =\> storage  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2020, 3:19pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524/6 "2020-12-31T15:19:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.