Mutiple beats on multiple servers sending logs to logstash through one pipeline

[prajwalgmpp (Prajwal)]

Hi. I have a requirement where I am supposed to enable log monitoring of NOI (Netcool Omnibus Impact) components through Elastic stack.

We have decided to install filebeats on all the components and send logs to logstash via a single pipeline.

Can a pipeline have multiple input beats plugin? If so, can it have multiple ports like:

input {
    beats
             {
              ports => port1, port 2..., port n
}
}
}

or should we write multiple pipelines for each beats input?

[leandrojmp (Leandro Pereira)]

There is no need to have multiple beats input, you can have only one beat input and configure all your filebeats to send to this same input.

But if you want, you can also have multiple beats inputs in one pipeline, but this is will work the same way as if you only have one beats input.

input {
    beats {
        port => port1
    }
    beats {
        port => port2
    }
    beats {
        port => portN
    }
}