# Multiple resources on conf

**URL:** <https://discuss.elastic.co/t/multiple-resources-on-conf/260079>\
**Category:** Logstash\
**Created:** [January 4, 2021, 10:52am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079 "2021-01-04T10:52:13Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sunflower](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Sunflower](https://discuss.elastic.co/u/Sunflower)\
**Post date:** [January 4, 2021, 10:52am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079/1 "2021-01-04T10:52:14Z")

</div>

Hi,

I have multiple resources that I want to configure to send Syslog to Logstash and then send it to S3.  
I'd appreciate hearing your thoughts regarding the two following options:

1. Multiple resources on the input, each resource would be configured with a unique port and would receive a unique type.
2. One resource on the input and then add different tags on the filter, using the grok plugin. I should dig into this matter.

Thank you.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [January 4, 2021, 10:54am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079/2 "2021-01-04T10:54:43Z")

</div>

1. Multiple inputs with same port will not be possible, every input is runned as separate thread and request to binf on that port

2. Yes this is possible if the ressource is provided with the tag at the source

---

<div class="post-metadata">

**Author:** ![Sunflower](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Sunflower](https://discuss.elastic.co/u/Sunflower)\
**Post date:** [January 4, 2021, 10:58am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079/3 "2021-01-04T10:58:52Z")

</div>

Hi 🙂  
Thank you for your super quick reply.  
Let me clarify the first option, I though of configuring multiple inputs, each one will have a different port and also I'd be able to add a type for each one of them and work on them separately in the filter. am I right?  
Is this option is better or the second one?

Thank you

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [January 4, 2021, 11:04am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079/4 "2021-01-04T11:04:33Z")

</div>

Yes if you configure multiple inputs, each one will bind a specific tcp/udp port will better for large scale, but again you need to configure each source of a group of sources to send to a specific port depending on the volume you have

---

<div class="post-metadata">

**Author:** ![Sunflower](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Sunflower](https://discuss.elastic.co/u/Sunflower)\
**Post date:** [January 4, 2021, 11:15am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079/5 "2021-01-04T11:15:30Z")

</div>

Got it, I think that would work for me.  
One more question regarding the second option, in case all the resources would send the logs using the same port, I would have to add tags to distinguish between the different resources, am I right?

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [January 4, 2021, 11:22am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079/6 "2021-01-04T11:22:06Z")

</div>

Only at the source level

---

<div class="post-metadata">

**Author:** ![Sunflower](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Sunflower](https://discuss.elastic.co/u/Sunflower)\
**Post date:** [January 4, 2021, 11:40am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079/7 "2021-01-04T11:40:59Z")

</div>

Thank you for your help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2021, 11:41am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079/8 "2021-02-01T11:41:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
