# Multiple input log, reading the same files

**URL:** <https://discuss.elastic.co/t/multiple-input-log-reading-the-same-files/344013>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 27, 2023, 8:45pm UTC](https://discuss.elastic.co/t/multiple-input-log-reading-the-same-files/344013 "2023-09-27T20:45:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [September 27, 2023, 8:45pm UTC](https://discuss.elastic.co/t/multiple-input-log-reading-the-same-files/344013/1 "2023-09-27T20:45:17Z")

</div>

Hi, it is posible to use multiple inputs on the same files, but with different filters?

The configuration below works but only if I run filebeat with: `./filebeat.exe -c filebeat.yml` not when I run it as a service

`UPDATE: if I delete one of the inputs, whichever, it works as a service, it seem that only can be two inputs to the same file? `

```auto
filebeat.inputs:

- type: log
  enabled: true
  paths:
    - E:\logs\log-20??_??_??.log
  exclude_lines: ['.*disabled.*','.*error.*','.*warning*.','.*Error.*']
  include_lines: ['.*_FS_ALL.*']  
  fields:
    categoria: discos
  fields_under_root: true
  ignore_older: 1h
- type: log
  enabled: true
  paths:
    - E:\logs\log-20??_??_??.log
  fields:
    categoria: metricas
  fields_under_root: true    
  exclude_lines: ['.*disabled.*','.*error.*','.*warning*.','.*Error.*']
  include_lines: ['.*_CPU','.*_Memoria','.*_Uptime','.*_Ping']
  ignore_older: 1h

- type: log
  enabled: true
  paths:
    - E:\logs\log-20??_??_??.log
  fields:
    categoria: sap
  fields_under_root: true    
  exclude_lines: ['.*disabled.*','.*error.*','.*warning*.','.*Error.*']
  include_lines: ['.*SAP .*']
  ignore_older: 1h

output.logstash:
  hosts: ["xxx:5044"]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2023, 10:45pm UTC](https://discuss.elastic.co/t/multiple-input-log-reading-the-same-files/344013/2 "2023-10-25T22:45:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.