Multiple beats input ports allowed on Logstash configuration?

Elastic Stack Logstash
1

I'm trying to achieve getting Logstash to listen to 2 different beats ports - one for filebeat and one for winlogbeat, by setting the conf file to be -

input {
  beats {
      id => "winlogbeat_plugin"
      port => 5044
  }
  beats {
      id => "filebeat_plugin"
      port => 5045
  }
}

But it seems, when the container is created out of this Logstash image, it only shows 5044 being listened to, in the netstat -an listing

Can Logstash only listen to 1 beats input at a time? Is there a downside to let both filebeat and winlogbeat send events to SingleIP:SinglePort for Logstash in their own configs?

2

Hi @omkarg81 ,

I do not run Logstash in a container so not sure what the problem could be but in a VM you can definitely run several beats inputs.

As long as all messages flow through the same Logstash pipeline, I do not think there is any significant difference between a single input or several inputs.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.