# Multiple output in logstash config, pls help! **URL:** \ **Category:** Logstash\ **Created:** [November 19, 2016, 9:21am UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615 "2016-11-19T09:21:03Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![reo7189](https://avatars.discourse-cdn.com/v4/letter/r/958977/32.png) [@reo7189](https://discuss.elastic.co/u/reo7189)\ **Post date:** [November 19, 2016, 9:21am UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615/1 "2016-11-19T09:21:03Z")
I managed to put multiple inputs/filters/outputs in one logstash conf, with no error or warning while running elasticsearch and logstash, but there is only one index in elasticsearch, pls help: my con is as below: input { beats { port =\> "5044" type =\> "applog" } udp { port =\> "514" type =\> "syslog" } } filter { if [type] == "applog" { grok { match =\> ["message", "%{COMBINEDAPACHELOG}"] } date { match =\> ["logdate", "dd/MMM/yyyy:HH:mm:ss Z"] } mutate { remove\_field =\> ["logdate"] } } if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } output { if [type] == "applog" { elasticsearch { hosts =\> ["192.168.11.2:9200"] index =\> "applog.logstash-%{+YYYY.MM.dd}" } } if [type] == "syslog" { elasticsearch { hosts =\> ["192.168.11.2:9200"] index =\> "syslog.logstash-%{+YYYY.MM.dd}" } } } as curl to elasticsearch, I got this: health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open .kibana fQuowSJwRMO8uQ17yzmqlw 1 1 2 0 10.1kb 10.1kb yellow open syslog.logstash-2016.11.19 PEsD8uhNSVSLj1U3hxkaJQ 5 1 1501 0 878.3kb 878.3kb what's wrong and what should I do? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 20, 2016, 4:38pm UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615/2 "2016-11-20T16:38:13Z")
Is Logstash receiving anything via the beats input? What do the logs on the sending side look like (Filebeat or whatever it is you're using)? ---
**Author:** ![reo7189](https://avatars.discourse-cdn.com/v4/letter/r/958977/32.png) [@reo7189](https://discuss.elastic.co/u/reo7189)\ **Post date:** [November 21, 2016, 5:57am UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615/3 "2016-11-21T05:57:03Z")
the sending side is : filebeat for sending nginx(access log), and winlogbeat for sending windows eventlog. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 21, 2016, 6:28am UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615/4 "2016-11-21T06:28:45Z")
Yes, and what do the logs of those applications say? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 21, 2016, 8:01am UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615/6 "2016-11-21T08:01:07Z")
No, I'm asking for the log of Filebeat itself. Is there any sign in its log that it's either successful or not successful in sending data to Logstash? ---
**Author:** ![reo7189](https://avatars.discourse-cdn.com/v4/letter/r/958977/32.png) [@reo7189](https://discuss.elastic.co/u/reo7189)\ **Post date:** [November 21, 2016, 1:04pm UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615/7 "2016-11-21T13:04:28Z")
Wow!, just check the filebeat log, it showed: 2016-11-21T20:59:18+08:00 INFO No non-zero metrics in the last 30s 2016-11-21T20:59:48+08:00 INFO No non-zero metrics in the last 30s 2016-11-21T21:00:18+08:00 INFO No non-zero metrics in the last 30s 2016-11-21T21:00:48+08:00 INFO No non-zero metrics in the last 30s 2016-11-21T21:01:18+08:00 INFO No non-zero metrics in the last 30s 2016-11-21T21:01:48+08:00 INFO No non-zero metrics in the last 30s 2016-11-21T21:02:18+08:00 INFO No non-zero metrics in the last 30s 2016-11-21T21:02:48+08:00 INFO No non-zero metrics in the last 30s 2016-11-21T21:03:18+08:00 INFO No non-zero metrics in the last 30s ---
**Author:** ![reo7189](https://avatars.discourse-cdn.com/v4/letter/r/958977/32.png) [@reo7189](https://discuss.elastic.co/u/reo7189)\ **Post date:** [November 22, 2016, 7:42am UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615/8 "2016-11-22T07:42:01Z")
Finally got this solved by using filebeat to elasticsearch directly, after restarting filebeat, everything is fine. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 20, 2016, 7:42am UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615/9 "2016-12-20T07:42:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.