# Multiple filebeat servers to configure single logstash

**URL:** <https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740>\
**Category:** Logstash\
**Created:** [November 27, 2019, 6:01pm UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740 "2019-11-27T18:01:58Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raavi\_Arun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raavi_arun/32/58390_2.png) [@Raavi\_Arun](https://discuss.elastic.co/u/Raavi_Arun)\
**Post date:** [November 27, 2019, 6:01pm UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740/1 "2019-11-27T18:01:58Z")

</div>

Hi,  
I am new to ELK. I am configured single web servers to single logstash in production. Now i am add filebeat in different web servers but i don't know how to configure all web server access log into single logstash. Please help with logstash and filebeat configurations. I already read multiple search but still i don't have exact answer. Please help me.

---

<div class="post-metadata">

**Author:** ![Mahesh\_Guntumadugu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahesh_guntumadugu/32/54413_2.png) [@Mahesh\_Guntumadugu](https://discuss.elastic.co/u/Mahesh_Guntumadugu)\
**Post date:** [November 28, 2019, 4:15am UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740/2 "2019-11-28T04:15:40Z")

</div>

Wherever filebeat is running point the ip and port (logstash ip and port).Make sure whatever the port you are using for logstash it should be open to take logss from filebeat machines.

#----------------------------- Logstash output --------------------------------  
output.logstash:

# The Logstash hosts

hosts: ["127.0.0.1:9600"]

---

<div class="post-metadata">

**Author:** ![Raavi\_Arun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raavi_arun/32/58390_2.png) [@Raavi\_Arun](https://discuss.elastic.co/u/Raavi_Arun)\
**Post date:** [November 28, 2019, 4:30am UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740/3 "2019-11-28T04:30:41Z")

</div>

Thanks mahesh. I am trying to connect with port 5044 to logstash from all servers. Does this work connect to single port from different filebeat servers

---

<div class="post-metadata">

**Author:** ![Mahesh\_Guntumadugu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahesh_guntumadugu/32/54413_2.png) [@Mahesh\_Guntumadugu](https://discuss.elastic.co/u/Mahesh_Guntumadugu)\
**Post date:** [November 28, 2019, 4:34am UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740/4 "2019-11-28T04:34:03Z")

</div>

Yes it will work.port should be open in Logstash node.You can send logs from different beats nodes.

---

<div class="post-metadata">

**Author:** ![Raavi\_Arun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raavi_arun/32/58390_2.png) [@Raavi\_Arun](https://discuss.elastic.co/u/Raavi_Arun)\
**Post date:** [November 28, 2019, 4:38am UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740/5 "2019-11-28T04:38:39Z")

</div>

Mahesh,Please explain How to do logstah configure to read logs from different servers.

---

<div class="post-metadata">

**Author:** ![Mahesh\_Guntumadugu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahesh_guntumadugu/32/54413_2.png) [@Mahesh\_Guntumadugu](https://discuss.elastic.co/u/Mahesh_Guntumadugu)\
**Post date:** [November 28, 2019, 4:43am UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740/6 "2019-11-28T04:43:19Z")

</div>

You have to write configuration in filebeat for each node (like log location and any additional fields ) once this is done, you have to write logstash filters in logstash filter section and redirect it to respective output.

```
- type: log
  enabled: true
  paths:  
  - C:\dummy\server1*.log
  input_type: log
  
  fields_under_root: true
  fields: 
   server: ABC
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2019, 4:43am UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740/7 "2019-12-26T04:43:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.