# Processing Custom Log Input from Filebeat in Logstash

**URL:** <https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656>\
**Category:** Logstash\
**Created:** [March 3, 2019, 9:46pm UTC](https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656 "2019-03-03T21:46:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![luke14](https://avatars.discourse-cdn.com/v4/letter/l/65b543/32.png) [@luke14](https://discuss.elastic.co/u/luke14)\
**Post date:** [March 3, 2019, 9:46pm UTC](https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656/1 "2019-03-03T21:46:20Z")

</div>

Hi

I have setup Filebeat on a server which I would like it to pass a custom application log to my logstash server.

On my logstash server I currently have a `beats_input.conf` which is listening for all my beats inputs. And a `beats_output.conf` which sends the data to elasticsearch. All this functionality is working well.

If I want to add in my custom log file, on my logstash server do I need a `beats_postprocess.conf` with my GROK filter in it. Or can I add my filter to the `beats_input.conf`?

What is the best practice here? All my other beats inputs are from Winlogbeat and are being processed by the `beats_input.conf` and the `beats_output.conf` file on my logstash server.

Any guidance would be appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\
**Post date:** [March 4, 2019, 7:08am UTC](https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656/2 "2019-03-04T07:08:22Z")

</div>

Hi mate,

I'm just starting with elastic stack, but for what i can see in the courses and books, you could have it all in one file if you wanted to, although most of the times they suggest having it all separated in different files.

As for my understanding, those files are read in alphabetical order, thus, you'll find that in lots of places they do/show something like.  
10\_input\_beats.conf  
20\_filter\_something.conf  
21\_filter\_somethingelse.conf  
30\_output\_elasticsearch.conf

For instance, you could see something like this, really easily if you get the elk docker from docker hub and see how they pre-configure those files in there.

Regards,

---

<div class="post-metadata">

**Author:** ![luke14](https://avatars.discourse-cdn.com/v4/letter/l/65b543/32.png) [@luke14](https://discuss.elastic.co/u/luke14)\
**Post date:** [March 4, 2019, 9:12am UTC](https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656/3 "2019-03-04T09:12:43Z")

</div>

Hi,

Thanks for the reply.

So If I place my GROK filter in a separate file, I assume only the beats input that MATCH that particular GROK filter will be processed by that file and everything else will simply fall through and simply just be output to elasticsearch as it is now?

Thanks

---

<div class="post-metadata">

**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\
**Post date:** [March 4, 2019, 9:23am UTC](https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656/4 "2019-03-04T09:23:57Z")

</div>

Hi,

In my case, it is working exactly like that, and also, that's what I understood from the things I've studied...so yes, if you place your GROK filter in a separate file, only the "inputs" (you could use other inputs beside beats) that match your "filters" (you can use other filters beside grok) will be processed by that file or files.

Just remember that things are applied alphabetically, so inputs before filters and filters before outputs (thus using numbers in front of the filenames).

For what I can understand, the reason for using different files is more a thing of ease of reading and ease for changing things, than a functionality thing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2019, 9:24am UTC](https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656/5 "2019-04-01T09:24:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.