# One Filebeat/One Logstash multiple pipelines

**URL:** <https://discuss.elastic.co/t/one-filebeat-one-logstash-multiple-pipelines/170145>\
**Category:** Discussions en français\
**Created:** [February 27, 2019, 10:54am UTC](https://discuss.elastic.co/t/one-filebeat-one-logstash-multiple-pipelines/170145 "2019-02-27T10:54:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ThibaudF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thibaudf/32/41361_2.png) [@ThibaudF](https://discuss.elastic.co/u/ThibaudF)\
**Post date:** [February 27, 2019, 10:54am UTC](https://discuss.elastic.co/t/one-filebeat-one-logstash-multiple-pipelines/170145/1 "2019-02-27T10:54:15Z")

</div>

Bonjour tout le monde, j'aimerais savoir si il était possible de link l'output filebeat au pipeline.id défini dans le pipelines.yml de logstash pour ne pas avoir à instancier plusieurs filebeat et n'utiliser qu'un port sur logstash, par exemple 5044, le filtrage serait implicite sur le pipeline.id?

pipelines.yml de logstash

```auto
    - pipeline.id: messages
      queue.type: persisted
      path.config: "/etc/logstash/conf.d/messages.conf"
    - pipeline.id: logtechs
      queue.type: persisted
      path.config: "/etc/logstash/conf.d/log_techs.conf"

```

Par exemple, pour le filebeat.yml :

```auto
    filebeat.inputs:
    - type: log
        enabled: true
        paths:
          - /*messages.log
        **pipeline.id: messages**
    - type: log
        enabled: true
        paths:
         - /*logtechs.log
        **pipeline.id: logtechs**

```

J'espère avoir été assez clair. Bonne journée !

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 27, 2019, 2:27pm UTC](https://discuss.elastic.co/t/one-filebeat-one-logstash-multiple-pipelines/170145/2 "2019-02-27T14:27:18Z")

</div>

Je ne vois pas d'option de ce type.

---

<div class="post-metadata">

**Author:** ![ThibaudF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thibaudf/32/41361_2.png) [@ThibaudF](https://discuss.elastic.co/u/ThibaudF)\
**Post date:** [February 28, 2019, 8:41am UTC](https://discuss.elastic.co/t/one-filebeat-one-logstash-multiple-pipelines/170145/3 "2019-02-28T08:41:36Z")

</div>

D'accord j'ai dû mal comprendre ce post :

> Instead of running multiple filebeat + Logstash with multiple ports, you can forward events to respective pipelines using conditionals. E.g. inputs in filebeat have a `pipeline` setting. This setting is used for selecting an Elasticsearch Ingest Node pipeline. I like to use the setting for sending to Logstash as well. If set the beat will send the pipeline name in `[@metadata][pipeline]` to Logstash. Here it can be used for filtering. Logstash drops the `[@metadata]` when publishing events to it's outputs.

Merci pour la réponse. Bonne journée !

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 28, 2019, 8:55am UTC](https://discuss.elastic.co/t/one-filebeat-one-logstash-multiple-pipelines/170145/4 "2019-02-28T08:55:28Z")

</div>

Oui. Ca veut dire que tu n'envoies que vers un seul pipeline logstash mais tu peux écrire des conditions pour exécuter x y ou z suivant la source.

Avec Ingest ce sera plus facile car tu vas envoyer vraiment vers des pipelines distincts.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2019, 8:55am UTC](https://discuss.elastic.co/t/one-filebeat-one-logstash-multiple-pipelines/170145/5 "2019-03-28T08:55:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.