# Multiple beats 1 input port with multiple index output

**URL:** <https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504>\
**Category:** Logstash\
**Created:** [March 8, 2019, 1:50pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504 "2019-03-08T13:50:57Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pedro\_Cabral](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedro_cabral/32/103308_2.png) [@Pedro\_Cabral](https://discuss.elastic.co/u/Pedro_Cabral)\
**Post date:** [March 8, 2019, 1:50pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/1 "2019-03-08T13:50:57Z")

</div>

Hello does anyone knows if is it possible to have multiple beats pointing to the same input port and then having multiple index output. Basically I need to identify which beat arrives and then add a tag to then have a proper output.  
Best Regards,  
Pedro Cabral

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 8, 2019, 5:24pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/2 "2019-03-08T17:24:07Z")

</div>

I believe you can have multiple beats servers connecting to the same port. I haven't scaled my testing to that yet though.

And yes, you can identify with tags on the beats server. Here is what I do on my filebeats

```auto
 filebeat.inputs:
	- type: log
		enabled: true
		paths:
			- /var/log/dmesg
		fields:
			dmesg: true
```

Notice how I set a field to dmesg: true? That is the check that I do in my pipeline on the logstash server.  
Then on my logstash server I have a pipelines.yml that looks like this:

```auto
- pipeline.id: filebeats
  config.string: |
    input { 
      beats { 
        port => 5044 
      } 
    }
    output {
      if "process" in [fields] {
          pipeline {
            send_to => process
          }
      }
      else if "dmesg" in [fields] {
        pipeline {
          send_to => dmesg_log
        }
      }
     }
- pipeline.id: process
  path.config: "/etc/logstash/conf.d/process/*"
- pipeline.id: dmesg
  path.config: "/etc/logstash/conf.d/dmesg/*"
```

Then inside my /etc/logstash/conf.d/dmesg/dmesg.input.conf

```auto
input {
  pipeline {
    address => dmesg_log
  }
```

Please note the use of the virtual addresses that were used for the dmesg. I called the virtual address "dmesg-log" in the pipelines.yml and then I used the same virtual address as the input for my dmesg.input.conf file. This is how you connect them together.

So the process would be:

- Assign a unique field in your filebeat.yml for each log file
- Check for that field inside your pipelines.yml
- Assign a virtual address if that field is there
- Add the virtual address for the pipeline.input.conf to the input

---

<div class="post-metadata">

**Author:** ![Pedro\_Cabral](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedro_cabral/32/103308_2.png) [@Pedro\_Cabral](https://discuss.elastic.co/u/Pedro_Cabral)\
**Post date:** [March 8, 2019, 6:34pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/3 "2019-03-08T18:34:17Z")

</div>

But this case you are just using filebeats.  
I want to use auditbeat, winlogbeat and packetbeat.

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 8, 2019, 7:18pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/4 "2019-03-08T19:18:44Z")

</div>

I haven't done the the field thing with winlogbeat, auditbeat, or patcketbeat. But I believe you can do that.  
I do have a winlogbeat sending files to a logstash server on port 5044, and I have different server that is sending filebeat files to the same logstash server on port 5044.

I am not sure if you can send winlogbeat and filebeat from the same server on the same port at the same time. I haven't tested this as of yet.

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 8, 2019, 7:29pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/5 "2019-03-08T19:29:08Z")

</div>

Actually, I just tested this, and I have winlogbeat and filebeat on the same system sending data to logstash at the same time on the same port.

So now I have the following going to a single logstash server on a single port:  
Windows 10 sending filebeat logs, and winlogbeat event logs.  
Linux server sending filebeat logs.

So yes, you can run multiple beats on the client, sending to the same port on the same server.

---

<div class="post-metadata">

**Author:** ![Pedro\_Cabral](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedro_cabral/32/103308_2.png) [@Pedro\_Cabral](https://discuss.elastic.co/u/Pedro_Cabral)\
**Post date:** [March 8, 2019, 7:41pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/6 "2019-03-08T19:41:34Z")

</div>

How can you identify on the logstash if is filebeat or winlogbeat to send with different index to elastic?

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 8, 2019, 9:44pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/7 "2019-03-08T21:44:19Z")

</div>

You can create the fields, like I had posted above. Passing the fields in, it will go all the way through logstash. You can either add the index on the input, output or the filter itself based off of the logic from the fields.

I haven't tested the fields with winlogbeat yet, and my test environment is a little tied up right now. But when it's done processing this massive log file, I will test.

---

<div class="post-metadata">

**Author:** ![Pedro\_Cabral](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedro_cabral/32/103308_2.png) [@Pedro\_Cabral](https://discuss.elastic.co/u/Pedro_Cabral)\
**Post date:** [March 8, 2019, 11:20pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/8 "2019-03-08T23:20:04Z")

</div>

It works thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2019, 11:20pm UTC](https://discuss.elastic.co/t/multiple-beats-1-input-port-with-multiple-index-output/171504/9 "2019-04-05T23:20:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.