# Logstash with multiple inputs and outputs **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-monitoring\ **Created:** [February 13, 2019, 3:10pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248 "2019-02-13T15:10:17Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Megha\_Shree](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@Megha\_Shree](https://discuss.elastic.co/u/Megha_Shree)\ **Post date:** [February 13, 2019, 3:10pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/1 "2019-02-13T15:10:17Z")
HI All, I am trying to send rsyslog and gelf msgs from logstash to Graylog server I am getting the below error :reason=\>"Expected one of #, { at line 18, column 12 (byte 207) after output {\n if [type] == "rsyslog\ my config file looks like this input { udp { host =\> "0.0.0.0" port =\> 10514 type =\> "rsyslog" } udp { host =\> "0.0.0.0" port =\> 12205 type =\> "gelf" } } filter {} output { if [type] == "rsyslog" { host =\> "172.16.0.27" port =\> 12201 protocol =\> "tcp" } if [type] == "gelf" { host =\> "172.16.0.27" port =\> 12202 protocol =\> "tcp" } stdout {} } can someone suggest please!! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 13, 2019, 3:28pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/2 "2019-02-13T15:28:36Z")
> [@Megha\_Shree](#): > > output { > if [type] == "rsyslog" { > host =\> "172.16.0.27" host is an option to an output. You have left out the output name. ---
**Author:** ![Megha\_Shree](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@Megha\_Shree](https://discuss.elastic.co/u/Megha_Shree)\ **Post date:** [February 13, 2019, 3:58pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/3 "2019-02-13T15:58:37Z")
so should I add a name field here like name =\> "syslog". I am very new to this. Thanks in advance ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 13, 2019, 4:00pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/4 "2019-02-13T16:00:36Z")
If you want to use a syslog output then yes, change host =\> "172.16.0.27" port =\> 12201 protocol =\> "tcp" to be syslog { host =\> "172.16.0.27" port =\> 12201 protocol =\> "tcp" } Similarly for the type gelf ---
**Author:** ![Megha\_Shree](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@Megha\_Shree](https://discuss.elastic.co/u/Megha_Shree)\ **Post date:** [February 13, 2019, 4:07pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/5 "2019-02-13T16:07:26Z")
still the same error. btw how does it gets to know which input to convert into which output format when we have multiple inputs. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 13, 2019, 4:13pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/6 "2019-02-13T16:13:32Z")
Exactly the same error? Same line and column numbers? If you have multiple input and outputs then it sends events from all the inputs to all the outputs unless you use conditionals to change that. ---
**Author:** ![Megha\_Shree](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@Megha\_Shree](https://discuss.elastic.co/u/Megha_Shree)\ **Post date:** [February 13, 2019, 4:20pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/7 "2019-02-13T16:20:36Z")
ok thanks.. sorry, this time its different logstash.outputs.gelf ] Invalid setting for gelf output plugin: output { gelf { # This setting must be a ["TCP", "UDP"] # Expected one of ["TCP", "UDP"], got ["tcp"] protocol =\> "tcp" ... } } [2019-02-13T16:15:11,315][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Something is wrong with your configuration."} I have changed the typr from tcp to TCP still the error continues ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 13, 2019, 4:38pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/8 "2019-02-13T16:38:19Z")
> [@Megha\_Shree](#): > > host =\> "172.16.0.27" > port =\> 12202 > protocol =\> "tcp" I find that error goes away if you change "tcp" to "TCP". You may have to restart. ---
**Author:** ![Megha\_Shree](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@Megha\_Shree](https://discuss.elastic.co/u/Megha_Shree)\ **Post date:** [February 13, 2019, 4:55pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/9 "2019-02-13T16:55:28Z")
I have changed the config file and restarted the machine but now it is saying something wrong with syslog output output { syslog { # This setting must be a ["tcp", "udp", "ssl-tcp"] # Expected one of ["tcp", "udp", "ssl-tcp"], got ["TCP"] protocol =\> "TCP" ... } } any idea? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 13, 2019, 5:04pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/10 "2019-02-13T17:04:12Z")
For a gelf output protocol has to be TCP, for a tcp output it has to be tcp. Logstash is full of little inconsistencies like this 🙂 ---
**Author:** ![Megha\_Shree](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@Megha\_Shree](https://discuss.elastic.co/u/Megha_Shree)\ **Post date:** [February 13, 2019, 5:15pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/11 "2019-02-13T17:15:52Z")
yea.. I was doing other way round. Thanks a ton 🙂 .. now my logstash works fine. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 13, 2019, 5:15pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248/12 "2019-03-13T17:15:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.