# Multiple inputs on the same port

**URL:** https://discuss.elastic.co/t/multiple-inputs-on-the-same-port/165391
**Category:** Logstash
**Created:** [January 23, 2019, 11:33am UTC](https://discuss.elastic.co/t/multiple-inputs-on-the-same-port/165391 "2019-01-23T11:33:44Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![hoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoff/32/30963_2.png) [@hoff](https://discuss.elastic.co/u/hoff)
#### Post date: [January 23, 2019, 11:33am UTC](https://discuss.elastic.co/t/multiple-inputs-on-the-same-port/165391/1 "2019-01-23T11:33:44Z")

</div>

I have five servers who generate 5 other jsons with two recognize field type (example value server1) and source (example value server\_name).  
My question is whether I can send data of five server on one input port and recognize based on type and source fields inputs and create 5 indexes in elasticsearch?

---

<div class="post-metadata">

### Author: ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)
#### Post date: [January 23, 2019, 1:02pm UTC](https://discuss.elastic.co/t/multiple-inputs-on-the-same-port/165391/2 "2019-01-23T13:02:45Z")

</div>

Hello @hoff,

Yes you can send and can apply filet with the loop of if else if .  
I was doing the same day before

Regards  
Shrikant

---

<div class="post-metadata">

### Author: ![hoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoff/32/30963_2.png) [@hoff](https://discuss.elastic.co/u/hoff)
#### Post date: [January 24, 2019, 9:58am UTC](https://discuss.elastic.co/t/multiple-inputs-on-the-same-port/165391/3 "2019-01-24T09:58:34Z")

</div>

I have configuration like that :

```
   tcp {
    port => 5044
    codec => json
  }
}

filter {
 if ([fields][servername] == "first") {
    mutate {
      replace => {
        "[type]" => "first"
      }
    }
  }
  else if ([fields][servername] == "second") {
    mutate {
      replace => {
        "[type]" => "second"
      }
    }
  }
}

output {

  elasticsearch {
   hosts => "x.x.x:x"
   manage_template => false
   index => "%{type}-%{+YYYY.MM.dd}"
}
}

```

This is example configuration with two servers for tests. Below you may see the name of the returned index.

 ![typ](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f2a9a2e2e62ba9731198c389dea0a3471cd0e993.jpeg)

---

<div class="post-metadata">

### Author: ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)
#### Post date: [January 24, 2019, 10:03am UTC](https://discuss.elastic.co/t/multiple-inputs-on-the-same-port/165391/4 "2019-01-24T10:03:15Z")

</div>

Hello @hoff

this is my logstash config file

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
if [service\_id] == "pDNcb2gBY7Thni\_1PwRv" {  
json {  
source =\> "message"  
}  
date {  
match =\> ["received", "yyyy-MM-dd HH:mm:ss"]  
target =\> "@timestamp"  
}  
}  
else {  
csv {  
separator =\> ","  
columns =\> ["request","Gender","Name","ID"]  
}  
date {  
match =\> ["received", "yyyy-MM-dd HH:mm:ss"]  
target =\> "@timestamp"  
}  
}  
}  
output{  
if [service\_id] == "pDNcb2gBY7Thni\_1PwRv" {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "index\_name"  
}  
stdout{}  
}  
else {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "index\_name"  
}  
stdout{}  
}  
}

---

<div class="post-metadata">

### Author: ![hoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoff/32/30963_2.png) [@hoff](https://discuss.elastic.co/u/hoff)
#### Post date: [January 24, 2019, 11:45am UTC](https://discuss.elastic.co/t/multiple-inputs-on-the-same-port/165391/5 "2019-01-24T11:45:03Z")

</div>

Thank you for replies [shrikantgulia](https://discuss.elastic.co/u/shrikantgulia).  
I solved my problem.  
I transformed the nested fields in the filter using a mutate and rename and the next I placed renamed field in output.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2019, 11:45am UTC](https://discuss.elastic.co/t/multiple-inputs-on-the-same-port/165391/6 "2019-02-21T11:45:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
