# Questions On Logstash Conf File

**URL:** https://discuss.elastic.co/t/questions-on-logstash-conf-file/282149
**Category:** Logstash
**Created:** [August 21, 2021, 11:58pm UTC](https://discuss.elastic.co/t/questions-on-logstash-conf-file/282149 "2021-08-21T23:58:41Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 22, 2021, 1:05am UTC](https://discuss.elastic.co/t/questions-on-logstash-conf-file/282149/2 "2021-08-22T01:05:43Z")

</div>

Your when using an architecture like

Beats \> Logstash \> Elasticsearch

Your Logstash conf file should look like the following

```auto
################################################
# beats->logstash->es default config.
################################################
input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      user => "elastic"
      password => "secret"
    }
  }
}

```

I also answered some additional detail about this architecture in [this post](https://discuss.elastic.co/t/metricbeat-to-logstash-to-elasticsearch-cannot-see-any-hosts-defined-but-data-is-definitely-coming-in/275715/2)

It happens to be metricbeat but it's very similar for winlogbeat

---

_[View the full topic](https://discuss.elastic.co/t/questions-on-logstash-conf-file/282149)._