Multiple lumberjack input in single logstash instance

Elastic Stack Logstash
1

Is multiple lumberjack inputs (in different ports) supported in a single logstash instance? The config as follow:-

input {
# stdin { codec => json {} }
 lumberjack {
  port => 6782
  codec => json {}
  ssl_certificate => "/opt/logstash-1.5.3/cert/logstash-forwarder.crt"
  ssl_key => "/opt/logstash-1.5.3/cert/logstash-forwarder.key"
  type => "lumberjack"
 }
 lumberjack {
  port => 6783
  ssl_certificate => "/opt/logstash-1.5.3/cert/logstash-forwarder.crt"
  ssl_key => "/opt/logstash-1.5.3/cert/logstash-forwarder.key"
  type => "lumberjack"
 }
}

filter {
  if [env] != "prod" {
    drop {}
  }
  if [message] =~ /^\s*$/ {
    drop { }
  }
}

output {
  if "_jsonparsefailure" in [tags] {
    file {
      path => "/var/log/shop/parse_error/%{env}/%{app}/%{app}_%{host}_%{+YYYY-MM-dd}.log"
    }
  } else {
    kafka {
      broker_list => ["kafka:9092"]
      topic_id => "logstash_logs"
    }
  }     
}
2

Yes. You can practically have any number of inputs of any type with the obvious restriction that they can't attempt to consume from the same file or socket.

3

Thanks Magnus :slight_smile: .