# Organizing Inputs **URL:** \ **Category:** Logstash\ **Created:** [October 4, 2016, 4:54pm UTC](https://discuss.elastic.co/t/organizing-inputs/62191 "2016-10-04T16:54:28Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Post date:** [October 4, 2016, 4:54pm UTC](https://discuss.elastic.co/t/organizing-inputs/62191/1 "2016-10-04T16:54:28Z")
With all of the different types of data that we ingest(Windows/Linus servers, firewalls, load-balancers, custom application logs, ect) how do you all organize your inputs to keep things from getting out of hand? I originally thought maybe I would open a port for each type of log file that will be sent from clients. But now that we are starting to ingest more and more I dont think that was the best choice. Since we will be moving from a virtual to a physical Elastic stack I thought it would be a good time to reevaluate how we are doing things. So any thoughts/suggestions/gotchas that you have come across would help. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 4, 2016, 7:22pm UTC](https://discuss.elastic.co/t/organizing-inputs/62191/2 "2016-10-04T19:22:38Z")
I prefer letting the sources declare all necessary fields needed for identification and filtering, using different ports on the Logstash side only to differentiate between protocols. One port for Beats and one for JSON over TCP/UDP goes a long way for me. You'll probably need one for syslog too. ---
**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Post date:** [October 4, 2016, 9:28pm UTC](https://discuss.elastic.co/t/organizing-inputs/62191/3 "2016-10-04T21:28:14Z")
A Logstash configuration just like you suggested and a single Filebeat/Winlogbeat configuration to keep things as simple as possible. Thanks!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/organizing-inputs/62191/4 "2017-07-06T04:35:49Z")
Closed on July 6, 2017, 4:35am UTC