# Most Efficient Way to Add filebeats to Logstash

**URL:** <https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410>\
**Category:** Logstash\
**Tags:** beats-module\
**Created:** [February 14, 2020, 4:13pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410 "2020-02-14T16:13:56Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\
**Post date:** [February 14, 2020, 4:13pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410/1 "2020-02-14T16:13:56Z")

</div>

Currently I have added beats to my logstash with there own port numbers and created new configs in logstash for each one of them. Is this the most efficient way to add filebeats to logstash when creating my stack.

Ex:

Filebeat1 output{"LSservername:5001"}  
Filebeat2 output{"LSservername:5002"}  
Filebeat3 output{"LSservername:5003"}  
Filebeat4 output{"LSservername:5004"}  
Filebeat5 output{"LSservername:5005"}

logstash(LS) configs  
config1input

input {  
beats {  
type =\> "\*\*\*"  
port =\> 5001  
}  
}  
config2input

input {  
beats {  
type =\> "\*\*\*"  
port =\> 5002  
}  
}

config 3 input

input {  
beats {  
type =\> "\*\*\*"  
port =\> 5003  
}  
}

config 4 input

input {  
beats {  
type =\> "\*\*\*"  
port =\> 5004  
}  
}  
config 5 input

input {  
beats {  
type =\> "\*\*\*"  
port =\> 5005  
}  
}

and so on ... We have many servers that will be sending all logs through the stack something like 300 so is there a better way to do this ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 14, 2020, 4:27pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410/2 "2020-02-14T16:27:35Z")

</div>

Are you using different ports so that you can assign a different type to each one? Why not use the source host as the field to identify the source?

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [February 14, 2020, 4:29pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410/3 "2020-02-14T16:29:06Z")

</div>

Filebeat logs of a "common format" can and probably should all go the same port/ in logstash, Each of these would be best in a logstash pipeline (of multi pipeline logstash) The only reason for seperate ports is if you need different processing, such maybe general iis logs vs those from Exchange.

What do you need to be different about each of these logstash configs?

---

<div class="post-metadata">

**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\
**Post date:** [February 14, 2020, 6:59pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410/4 "2020-02-14T18:59:24Z")

</div>

I was using different ports because when I tried to send all of the filebeats to 5044 it seemed like all of the logs were not going through .. but when I separated the filebeats by ports it all worked better

---

<div class="post-metadata">

**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\
**Post date:** [February 14, 2020, 7:01pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410/5 "2020-02-14T19:01:39Z")

</div>

so what it sounds like your saying is that this should work fine ?

Ex:

Filebeat1 output{"LSservername:5044"}  
Filebeat2 output{"LSservername:5044"}  
Filebeat3 output{"LSservername:5044"}  
Filebeat4 output{"LSservername:5044"}  
Filebeat5 output{"LSservername:5044"}

logstash(LS) configs  
config1input

input {  
beats {  
port =\> 5044  
}  
}

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [February 14, 2020, 9:00pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410/6 "2020-02-14T21:00:00Z")

</div>

I just did a quick check

```
  "aggs": {
    "1": {
      "cardinality": {
        "field": "agent.hostname"
      }
    }
  },

```

for my winlogbeat shows 353 unique hosts sending to the same port, but I'm running 4 logstash servers. The beats config lists all of them to load balance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2020, 9:00pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-add-filebeats-to-logstash/219410/7 "2020-03-13T21:00:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.