# Questions about the Logstash Configuration

**URL:** https://discuss.elastic.co/t/questions-about-the-logstash-configuration/95437
**Category:** Logstash
**Created:** [August 2, 2017, 1:33am UTC](https://discuss.elastic.co/t/questions-about-the-logstash-configuration/95437 "2017-08-02T01:33:33Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![LeonSun](https://avatars.discourse-cdn.com/v4/letter/l/71e660/32.png) [@LeonSun](https://discuss.elastic.co/u/LeonSun)
#### Post date: [August 2, 2017, 1:33am UTC](https://discuss.elastic.co/t/questions-about-the-logstash-configuration/95437/1 "2017-08-02T01:33:33Z")

</div>

Hi, I am new to Logstash, I built up 2 configuration file on my server for 2 types of log; I put the 2 types of logs into different folder:/FW\_Log and /VAL-LOG; , and put the 2 config files under same folder: /logstash/configs/ and run : ./bin/logstash -f ./configs/ ; the logstash can read the log files from both 2 folders, but the logs read from both 2 folders are all using the first configuration to split the log?

**Config A:**  
#data input  
input{  
file{  
path =\> ["/logserver/FW\_LOG/_._"]  
type =\> "system"  
start\_position =\> "beginning"}  
}  
#data filter  
filter{  
mutate{  
split=\>["message","] "]  
add\_field=\>{  
"field1"=\>"%{[message][0]}"  
}  
add\_field=\>{  
"loginfo"=\>"%{[message][1]}"  
}  
remove\_field=\>["message"]  
}  
#data output  
output{  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
}

Config B:  
#data input  
input{  
file{  
path =\> ["/logserver/VAL\_LOG/_._"]  
type =\> "system"  
start\_position =\> "beginning"}  
}  
#data filter  
filter{  
grok{  
match =\> {  
"message" =\> "\s\*%{TIME:TestTime}\s\*.%{LOGLEVEL:log\_level}\s\*.\s\*%{GREEDYDATA:loginfo}"  
}  
remove\_field =\> ["message"]  
}  
}  
#data output  
output{  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
}

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 2, 2017, 1:44am UTC](https://discuss.elastic.co/t/questions-about-the-logstash-configuration/95437/2 "2017-08-02T01:44:24Z")

</div>

Config files are merged together, you need to use something like this to split them - [https://www.elastic.co/guide/en/logstash/current/config-examples.html#using-conditionals](https://www.elastic.co/guide/en/logstash/current/config-examples.html#using-conditionals)

---

<div class="post-metadata">

### Author: ![LeonSun](https://avatars.discourse-cdn.com/v4/letter/l/71e660/32.png) [@LeonSun](https://discuss.elastic.co/u/LeonSun)
#### Post date: [August 2, 2017, 4:03am UTC](https://discuss.elastic.co/t/questions-about-the-logstash-configuration/95437/3 "2017-08-02T04:03:14Z")

</div>

it fixed my problem, thanks a lot;

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2017, 4:03am UTC](https://discuss.elastic.co/t/questions-about-the-logstash-configuration/95437/4 "2017-08-30T04:03:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
