# Multiple Filebeat Inputs to different Logstash ports

**URL:** <https://discuss.elastic.co/t/multiple-filebeat-inputs-to-different-logstash-ports/226273>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 2, 2020, 7:01pm UTC](https://discuss.elastic.co/t/multiple-filebeat-inputs-to-different-logstash-ports/226273 "2020-04-02T19:01:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![radd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radd/32/72770_2.png) [@radd](https://discuss.elastic.co/u/radd)\
**Post date:** [April 2, 2020, 7:01pm UTC](https://discuss.elastic.co/t/multiple-filebeat-inputs-to-different-logstash-ports/226273/1 "2020-04-02T19:01:02Z")

</div>

Hi,  
I am trying to send 3 total different logs from server A using filebeat, to server B running logstash on 3 different ports, based on different pipelines.

Server A,filebeat, file\_1.log ---------\> Server B, logstash with pipeline\_1 on prot 5051  
Server A,filebeat, file\_2.log ---------\> Server B, logstash with pipeline\_2 on prot 6051  
Server A,filebeat, file\_3.log ---------\> Server B, logstash with pipeline\_3 on prot 7051

file\_1.log \<\> file\_2.log \<\> file\_3.log (different log files on server A)  
pipeline\_1 \<\> pipeline\_2 \<\> pipeline\_3 (different conf files on server B)

Could I start 3 different filebeat instances on server A with 3 different filebeat.yml configurations (when installation is rpm based).

I really don't have much experience in this area. Could you please help me to resolve this problem.  
I am using ELK 7.6

Many thanks,  
rd

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [April 3, 2020, 9:00am UTC](https://discuss.elastic.co/t/multiple-filebeat-inputs-to-different-logstash-ports/226273/2 "2020-04-03T09:00:19Z")

</div>

Hey!

What you are thinking of seems to be valid.  
I found a similar post too explaining the reasoning of this approach a little bit: [Conditional filebeat output to logstash](https://discuss.elastic.co/t/conditional-filebeat-output-to-logstash/156303)

C.

---

<div class="post-metadata">

**Author:** ![radd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radd/32/72770_2.png) [@radd](https://discuss.elastic.co/u/radd)\
**Post date:** [April 4, 2020, 10:20am UTC](https://discuss.elastic.co/t/multiple-filebeat-inputs-to-different-logstash-ports/226273/3 "2020-04-04T10:20:36Z")

</div>

Hi,  
Thanks, I have solved my problem on this way (after reading documentation and from other Internet resources):

- on the FILEBEAT side setup filebeat.yml to have references on my all log files (using filebeat.config.inputs attribute) and tags related wit every input file
- on the LOGSTASH side setup one configuration file, now listening on on unique port and then  
inside one big configuration file use "if, elseif" based on the tags, so every time we have the execution of adequate part of pipline configuration (based on its tag)

Many thanks,  
rd

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2020, 10:20am UTC](https://discuss.elastic.co/t/multiple-filebeat-inputs-to-different-logstash-ports/226273/4 "2020-05-02T10:20:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.