# Multiple Beats Input (filebeat, topbeat)
**URL:** https://discuss.elastic.co/t/multiple-beats-input-filebeat-topbeat/47149
**Category:** Logstash
**Created:** [April 12, 2016, 4:19pm UTC](https://discuss.elastic.co/t/multiple-beats-input-filebeat-topbeat/47149 "2016-04-12T16:19:03Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@nocode](https://discuss.elastic.co/u/nocode)
#### Post date: [April 12, 2016, 4:19pm UTC](https://discuss.elastic.co/t/multiple-beats-input-filebeat-topbeat/47149/1 "2016-04-12T16:19:03Z")
So I've configured an ELK stack. Initially, I configured my logging to use json format and used filebeat to send to logstash. Once I got that working, I wanted to start collecting system metrics so I disabled the filebeat configuration and created a topbeat one.
I'm not curious, how can I combine these two using a single beats input in logstash? I've been reading up on conditionals and was thinking of setting conditionals on `document_type` but I don't see that option in topbeat.
Ideally, I would like to configure a single port to be used and not have multiple logstash configs (with multiple ports open).
---
### Author:  [@nocode](https://discuss.elastic.co/u/nocode)
#### Post date: [April 12, 2016, 4:50pm UTC](https://discuss.elastic.co/t/multiple-beats-input-filebeat-topbeat/47149/2 "2016-04-12T16:50:49Z")
I'm wondering if setting a conditional on `type` would be advised?
Configuration
```auto
input {
beats {
host => "x.x.x.x"
port => 5000
}
}
output {
if [type] == "system" or [type] == "filesystem" or [type] == "process" {
elasticsearch {
hosts => ["x.x.x.x:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
template_name => "topbeat"
template => "/etc/logstash/mappings/topbeat.json"
}
}
if [document_type] == "nginx-access" {
do something here
}
}
```
system, filesystem and process were the only fields I could see would be unique in conjunction with whatever my application logs would be sending. I'm setting the `document_type` in Filebeat but I don't see this option in Topbeat.
---
### Author:  [@nocode](https://discuss.elastic.co/u/nocode)
#### Post date: [April 12, 2016, 6:19pm UTC](https://discuss.elastic.co/t/multiple-beats-input-filebeat-topbeat/47149/3 "2016-04-12T18:19:14Z")
I think I solved my question, here's the config I'm using for reference:
```auto
input {
beats {
host => "x.x.x.x"
port => 5000
codec => "json"
}
}
output {
if [type] == "system" or [type] == "filesystem" or [type] == "process" {
elasticsearch {
hosts => ["x.x.x.x:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
template_name => "topbeat"
template => "/etc/logstash/mappings/topbeat.json"
}
}
if [type] == "nginx-access" {
elasticsearch {
hosts => ["x.x.x.x:9200"]
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/multiple-beats-input-filebeat-topbeat/47149/4 "2017-07-06T05:02:44Z")