# Manage multiple beats on a single Logstash instance

**URL:** <https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545>\
**Category:** Logstash\
**Created:** [October 8, 2016, 5:51am UTC](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545 "2016-10-08T05:51:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![espogian](https://avatars.discourse-cdn.com/v4/letter/e/4491bb/32.png) [@espogian](https://discuss.elastic.co/u/espogian)\
**Post date:** [October 8, 2016, 5:51am UTC](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545/1 "2016-10-08T05:51:04Z")

</div>

Hello, I have multiple porspectors on a filebeat.yml configuration file. Each of these prospector has a unique type:

```
filebeat:
  prospectors:
    -
      paths:
        - file*.csv
      input_type: log
      document_type: type1
    -
      paths:
        - file*.log
      input_type: log
      document_type: type2
[...]

```

While the Logstash configuration is like this:

```
input {
  beats {
    port => 5044
	}
       }

filter {
  if [type] == "type2" {
    grok { [some-grok-configuration-here] }
  }
  else if [type] == "type1" {
    csv { [some-csv-configuration-here] }

output {
  if [type] == "type2" {
    elasticsearch {
      hosts => ["elasticsearch:9200"]
      index => "logstash-type2-%{+YYYY.MM.dd}"
    }
    stdout { codec => rubydebug }
  }
  else if [type] == "type1" {
    elasticsearch {
      hosts => ["elasticsearch:9200"]
      index => "logstash-type1%{+YYYY.MM.dd}"
    }
    stdout { codec => rubydebug }
  }
}

```

From the Filebeat log I see that all the files are correctly sent with the correct "type" field to Logstash. However, Logstash pipeline is only showing type2 and obviously I can't find type1 on Elasticsearch.  
Could you help me figuring out why this is happening?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 8, 2016, 5:51am UTC](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545/2 "2016-10-08T05:51:55Z")

</div>

Are they showing in stdout at all?

---

<div class="post-metadata">

**Author:** ![espogian](https://avatars.discourse-cdn.com/v4/letter/e/4491bb/32.png) [@espogian](https://discuss.elastic.co/u/espogian)\
**Post date:** [October 8, 2016, 5:52am UTC](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545/3 "2016-10-08T05:52:31Z")

</div>

In Logstash stdout only one type is showing

---

<div class="post-metadata">

**Author:** ![espogian](https://avatars.discourse-cdn.com/v4/letter/e/4491bb/32.png) [@espogian](https://discuss.elastic.co/u/espogian)\
**Post date:** [October 8, 2016, 6:14am UTC](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545/4 "2016-10-08T06:14:25Z")

</div>

I have noticed that when there is only one beat type (hence when I don't use conditionals in Logstash configuration) the stdout of the CSV has a pre-defined "Normal" type:

```
"@version" => "1",
"@timestamp" => "2016-09-19T05:49:56.269Z",
"type" => "Normal",

```

Even if I didn't defined one. Maybe this is the cause, because in the conditionals I'm referring to the type set by Filebeat.

---

<div class="post-metadata">

**Author:** ![espogian](https://avatars.discourse-cdn.com/v4/letter/e/4491bb/32.png) [@espogian](https://discuss.elastic.co/u/espogian)\
**Post date:** [October 8, 2016, 6:20am UTC](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545/5 "2016-10-08T06:20:49Z")

</div>

Yes, issue solved! 🙂

I've added a

```
mutate { replace => { "type" => "type2" } }

```

Inside the Logstash filter section and now it works like a charm.  
Was this approach the correct one?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545/6 "2017-07-06T04:35:03Z")

</div>