# Logstash with multiple inputs

**URL:** <https://discuss.elastic.co/t/logstash-with-multiple-inputs/79326>\
**Category:** Logstash\
**Created:** [March 20, 2017, 10:59pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs/79326 "2017-03-20T22:59:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)\
**Post date:** [March 20, 2017, 10:59pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs/79326/1 "2017-03-20T22:59:53Z")

</div>

I have beats shipping syslog and nxlog shipping iis logs to logstash.

So I have this in my logstash config:  
input {  
beats {  
port =\> "3333"  
}  
tcp {  
type =\> "iis"  
port =\> "5555"  
}  
}

and for output:  
output {  
if [type] == "syslog" {  
elasticsearch {  
hosts =\> "mycluster"  
index =\> "logstash-syslog-%{+YYYY-MM-dd}"  
}  
} else if [type] == "iis" {  
elasticsearch {  
hosts =\> "mycluster"  
index =\> "logstash-iis-%{+YYYY-MM-dd}"  
}  
} else {  
elasticsearch {  
hosts =\> "mycluster"  
index =\> "uncategorized"  
}  
}  
}

And this is my beats config for shipping syslogs:  
filebeat:  
prospectors:  
-  
paths:  
- /var/log/messages  
- /var/log/audit/audit.log  
document\_type: syslog #"type" that is read by logstash  
output:  
logstash:  
hosts: ["myserver:3333"]

But my syslog logs are getting dumped in the iis index. Why is this happening? If their coming from a beats clients why are they getting into the tcp input?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 21, 2017, 6:13am UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs/79326/2 "2017-03-21T06:13:23Z")

</div>

Please show an example of such an event. Copy/paste from the JSON tab of Kibana's Discover panel. No screenshots please.

---

<div class="post-metadata">

**Author:** ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)\
**Post date:** [March 22, 2017, 12:44am UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs/79326/3 "2017-03-22T00:44:41Z")

</div>

sorry this was a problem with my client config. It was point to the wrong port- my fault!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2017, 12:44am UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs/79326/4 "2017-04-19T00:44:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.