Pass multiple inputs in logstash config. file

Is this the right way to give multiple input..because i am not geeting logs on kibana. due to this i have to restart logstash after some interval continuously.

input {
beats {
port => 5044
}
}

input {
cloudwatch_logs {
log_group => [ "/aws/rds/instance/trips3m-prod-master/slowquery" ]
region => "us-east-1"
type=> "rds"
}
}

input {
cloudwatch_logs {
log_group => [ "/aws/rds/instance/trips3m-read-private-new/slowquery" ]
region => "us-east-1"
type=> "rds_slave"
}
}

output {
elasticsearch {
hosts => ["http://0.0.0.0:9200"]
index => "%{[@metadata][indexname]}-%{+YYYY.MM.dd}"
}

Only use input once.

input {
  beats {
    port => 5044
  }
  cloudwatch_logs {
    log_group => [ "/aws/rds/instance/trips3m-prod-master/slowquery" ]
    region => "us-east-1"
    type=> "rds"
  }
  cloudwatch_logs {
    log_group => [ "/aws/rds/instance/trips3m-read-private-new/slowquery" ]
    region => "us-east-1"
    type=> "rds_slave"
  }
}

filter {}

output {
  elasticsearch {
    hosts => ["http://0.0.0.0:9200"]
    index => "%{[@metadata][indexname]}-%{+YYYY.MM.dd}"
  }
}
1 Like

thanks @A_B its a good approach.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.