[0-9]{4})\s*\,\s*%{GREEDYDATA:message_context}"
]
}
}
output {
elasticsearch {
hosts => ["192.168.200.42:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
}
}
```
This is working as expected. I have added a another config file called stackhealth.conf and added the below content for that/
**FIle name :** stackhealth.conf
```
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => ["received_at", "%{@timestamp}"]
add_field => ["received_from", "%{host}"]
}
syslog_pri { }
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
output {
elasticsearch {
hosts => ["192.168.200.42:9200"]
sniffing => true
manage_template => false
index => "syshealth-index"
document_type => "%{[@metadata][type]}"
}
}
```
After I added bother files to the /etc/logstash/conf.d location still it only processes the custom.conf. How to make both works ?
---
### Author:  [@ventrca](https://discuss.elastic.co/u/ventrca)
#### Post date: [May 10, 2018, 9:59am UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/2 "2018-05-10T09:59:30Z")
Multiple pipelines is the answer. [https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html)
For your problem, maybe you are not modifying pipelines.yml?
---
### Author:  [@Dazith\_Kj](https://discuss.elastic.co/u/Dazith_Kj)
#### Post date: [May 10, 2018, 10:18am UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/3 "2018-05-10T10:18:11Z")
Hi @ventrca.
I am not seeing pipelines.yml in my logstash setup under /etc/logstash/conf.d. Any idea on this ?
---
### Author:  [@ventrca](https://discuss.elastic.co/u/ventrca)
#### Post date: [May 10, 2018, 10:30am UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/4 "2018-05-10T10:30:18Z")
Which version are you using? I have it in logstash/config
---
### Author:  [@Dazith\_Kj](https://discuss.elastic.co/u/Dazith_Kj)
#### Post date: [May 10, 2018, 10:36am UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/5 "2018-05-10T10:36:03Z")
Below is the log stash version @ventrca
> root@localhost:/opt/logstash/bin# ./logstash -V
> logstash 2.2.4
I have only two conf files which I have created under /etc/logstash/conf.d
> root@localhost:/etc/logstash/conf.d# ls
> stackhealth.conf test.conf
---
### Author:  [@ventrca](https://discuss.elastic.co/u/ventrca)
#### Post date: [May 10, 2018, 10:37am UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/6 "2018-05-10T10:37:23Z")
Sorry, I can't help you with this. I'm using the 6.6.2
---
### Author:  [@Dazith\_Kj](https://discuss.elastic.co/u/Dazith_Kj)
#### Post date: [May 10, 2018, 10:40am UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/7 "2018-05-10T10:40:15Z")
Thanks @ventrca !
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 16, 2018, 8:24pm UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/8 "2018-05-16T20:24:09Z")
> Multiple pipelines is the answer.
The problem is that you can't have two beats input that listen on the same port. Multiple pipelines won't help there.
---
### Author:  [@Dazith\_Kj](https://discuss.elastic.co/u/Dazith_Kj)
#### Post date: [May 17, 2018, 10:53am UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/9 "2018-05-17T10:53:10Z")
Thanks @magnusbaeck. Is there any other way to satisfy this requirement ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 17, 2018, 1:53pm UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/10 "2018-05-17T13:53:04Z")
> Is there any other way to satisfy this requirement ?
What requirement? Multiple configuration files?
---
### Author:  [@Dazith\_Kj](https://discuss.elastic.co/u/Dazith_Kj)
#### Post date: [May 17, 2018, 2:57pm UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/11 "2018-05-17T14:57:27Z")
@magnusbaeck what I need is publish specific data which matches two patterns to two different indexes in ES. If the requirement is not clear please let me know. Ill explain more with a simple example.
---
### Author:  [@darkmoon](https://discuss.elastic.co/u/darkmoon)
#### Post date: [May 17, 2018, 7:16pm UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/12 "2018-05-17T19:16:24Z")
Either have your two sources identify them selves (with a custom field, maybe) and use that to route your documents, or you can have two listeners (on different ports) that add the routing data.
You can set a @metadata field with the name of the index you want a document to be indexed to, then use that field in the output block.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2018, 7:16pm UTC](https://discuss.elastic.co/t/multiple-conf-files-handling-issue-in-logstash/131278/13 "2018-06-14T19:16:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.