# Migrating from Graylog to Logstash (SOLVED)

**URL:** <https://discuss.elastic.co/t/migrating-from-graylog-to-logstash-solved/64005>\
**Category:** Logstash\
**Created:** [October 26, 2016, 1:00pm UTC](https://discuss.elastic.co/t/migrating-from-graylog-to-logstash-solved/64005 "2016-10-26T13:00:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Houss](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@Houss](https://discuss.elastic.co/u/Houss)\
**Post date:** [October 26, 2016, 1:00pm UTC](https://discuss.elastic.co/t/migrating-from-graylog-to-logstash-solved/64005/1 "2016-10-26T13:00:46Z")

</div>

Hello,

At the moment our cluster is composed of:

- 4 elasticsearch nodes
- 3 graylog instances for the logs processing/extractors
- Kibana for the visualization (graph, dashboard)

I want to upgrade our elastic nodes to 5.0, but unfortunately, graylog isn't supporting it yet.  
I am planning of using Logstash instead, and have a few questions:

1. Can't we start one logstash for all the inputs we wanna have ? I saw that we can configure multiple inputs and outputs in one files but I don't understand how we can define filter to be applied on specific input logs ? Also, are we forced to use the /bin/logstash command everytime, or is there a way to tell logstash to start automatically for all the inputs ?

2. I spent a lot of time in graylog to make extractors, and create all the fields. Graylog has a json export of all extractors, which looks like this :

My question is : will I be able to reuse those regex somehow with logstash ?

1. Will I have to relaunch Logstash every time I want to add an input or modify something ?

Thanks!

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [October 26, 2016, 4:06pm UTC](https://discuss.elastic.co/t/migrating-from-graylog-to-logstash-solved/64005/2 "2016-10-26T16:06:08Z")

</div>

Answers:

1. People do run with multiple inputs. Usually they set the "type" to a string e.g. apache, then in the filter section of the config you would "guard" a filter with an if statement.  
e.g.

```auto
input {
  file {
    ....
    type => "apache"
  }
}
filter {
  if [type] == "apache" {
    <apache specific filters here>
  } else if [type] == other {
     
  } else {
    
  }
}

```

1. You might be able to, but our Grok filter comes with many patterns built in.
2. In Logstash 5.0 (released today) there is a config reload feature which will sense that the config has been edited and do the internal reloading for you.

---

<div class="post-metadata">

**Author:** ![Houss](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@Houss](https://discuss.elastic.co/u/Houss)\
**Post date:** [October 26, 2016, 4:19pm UTC](https://discuss.elastic.co/t/migrating-from-graylog-to-logstash-solved/64005/3 "2016-10-26T16:19:52Z")

</div>

Thanks for these answers, it helped lots !

Cheers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/migrating-from-graylog-to-logstash-solved/64005/4 "2017-07-06T04:32:35Z")

</div>