# Multiple Log Files With Different Output Fails

**URL:** <https://discuss.elastic.co/t/multiple-log-files-with-different-output-fails/151590>\
**Category:** Logstash\
**Created:** [October 9, 2018, 9:25am UTC](https://discuss.elastic.co/t/multiple-log-files-with-different-output-fails/151590 "2018-10-09T09:25:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sparsh\_Singhal](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@Sparsh\_Singhal](https://discuss.elastic.co/u/Sparsh_Singhal)\
**Post date:** [October 9, 2018, 9:25am UTC](https://discuss.elastic.co/t/multiple-log-files-with-different-output-fails/151590/1 "2018-10-09T09:25:10Z")

</div>

I am getting 3 log files from the FileBeat on 4 nodes. Only 1 log from single node is getting indexed in elasticsearch.

```
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

filter {
    if [fields][log_type] == "namenode" {
    grok {
      match => {
      "message" => "%{DATESTAMP:log_timestamp} %{LOGLEVEL:log_level} (?<log_action>\b\w+(\.\w+)?\b) (%{DATA:log_actor}) - %{GREEDYDATA:log_message}"
      }
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["log_timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
      target => "log_timestamp"
    }
  }
  else if [fields][log_type] == "namenode_audit" {
    grok {
      match => {
      "message" => "%{DATESTAMP:log_timestamp} %{LOGLEVEL:log_level} (?:\b\w+(\.\w+)?\b): allowed=(?<allowed>true|false) ugi=%{DATA:user} (%{DATA:authentication_type}) ip=/%{IPV4:host_requested} cmd=%{DATA:command} src=%{DATA:source} dst=%{DATA:destination} perm=%{DATA:permission} proto=%{GREEDYDATA:protocol}"
      }
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["log_timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
      target => "log_timestamp"
    }
  }
  else if [fields][log_type] == "resource_manager" {
    grok {
      match => {
      "message" => "%{GREEDYDATA:data}"
      }
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["log_timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
      target => "log_timestamp"
    }
  }
}

output {
  elasticsearch {
    hosts => "localhost:9200"
    index => "%{[fields][log_type]}-%{[beat][hostname]}"
    manage_template => false
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2018, 9:25am UTC](https://discuss.elastic.co/t/multiple-log-files-with-different-output-fails/151590/2 "2018-11-06T09:25:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.