# Problem with parsing data from two files inputs (csv and syslog)
**URL:** https://discuss.elastic.co/t/problem-with-parsing-data-from-two-files-inputs-csv-and-syslog/97730
**Category:** Logstash
**Created:** [August 21, 2017, 9:09am UTC](https://discuss.elastic.co/t/problem-with-parsing-data-from-two-files-inputs-csv-and-syslog/97730 "2017-08-21T09:09:45Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@myciokas](https://discuss.elastic.co/u/myciokas)
#### Post date: [August 21, 2017, 9:09am UTC](https://discuss.elastic.co/t/problem-with-parsing-data-from-two-files-inputs-csv-and-syslog/97730/1 "2017-08-21T09:09:45Z")
Hello,
i have problems with input from a file.
Info: logstash 5.5, OS centos7
Problem: if i leave only one conf file in logstash/conf.d - it works,but if i put them together it's starting to fail. (conf files and part from logs- added. )
example, when parsing correct input to csv file it's add [tags ["\_grokparsefailure"]] others fields - ok.(in kibana),
But if i insert bad data to file, i get error in /var/log/logstash/logstash-plain.log : [WARN][logstash.filters.csv] Error parsing csv {:field=\>"message", :source=\> .... and then fail is starting, seems that logstash.filters.csv trying to parse logstash-plain.log warn log, and it get's warn that failed to parse, so it's closed circle.
HOW to make, that config 10-test.conf will parse only his files, and syslog config parse only his files?
i created first input(10-test.conf), from file (csv type) (short version of config) //everything works if there only one config//
input {
file {
path =\> "/var/log/test1/\*.log"
start\_position =\> end
sincedb\_path =\> "/dev/null"
} }
filter { csv {
separator =\> ","
columns =\> ["TIMESTAMP","EVENT\_TYPE","MSG\_SIZE" .... and etc]
convert =\> { "MSG\_SIZE" =\> "integer" }
remove\_field =\> ["field\_1", "field\_2", and ect]
}
// there some replaces x20
if [MSG\_TYPE] == "1"{ mutate { replace =\> ["MSG\_TYPE", "newfield1"] }}
}
output {
udp {
host =\> "192.168.100.152"
port =\> 12207
}
}
second config, from file (99-syslog.conf) ( /var/log/logstash/logstash-plain.log) // everything works if there only one config //
input {
file {
type =\> "syslog"
path =\> "/var/log/logstash/logstash-plain.log"
start\_position =\> end
}}
filter {
grok {
match =\> { "message" =\> "[%{TIMESTAMP\_ISO8601:timestamp}][%{LOGLEVEL:loglevel}%{SPACE}][%{DATA:logstash\_filter}%{SPACE}] %{WORD:status }} } }
output {
udp {
host =\> "192.168.100.152"
port =\> 12207
} }
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 21, 2017, 9:14am UTC](https://discuss.elastic.co/t/problem-with-parsing-data-from-two-files-inputs-csv-and-syslog/97730/2 "2017-08-21T09:14:52Z")
At the moment, all config files are merged into a single pipeline by Logstash, which requires the use of [conditionals](https://www.elastic.co/guide/en/logstash/5.5/event-dependent-configuration.html#conditionals). This will however be changing the upcoming Logstash 6.0 with the ability to define multiple pipelines within a single Logstash instance, as described in [this blog post](https://www.elastic.co/blog/logstash-multiple-pipelines).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 18, 2017, 9:14am UTC](https://discuss.elastic.co/t/problem-with-parsing-data-from-two-files-inputs-csv-and-syslog/97730/3 "2017-09-18T09:14:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.