# Receive multiple Logstash inputs with TCP, UDP and Beats

**URL:** <https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 18, 2021, 7:30pm UTC](https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020 "2021-10-18T19:30:47Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![sakshat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sakshat/32/96046_2.png) [@sakshat](https://discuss.elastic.co/u/sakshat)\
**Post date:** [October 18, 2021, 8:28pm UTC](https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020/3 "2021-10-18T20:28:12Z")

</div>

pipelines.yml

```auto
- pipeline.id: pcf
  path.config: "/etc/logstash/conf.d/syslog.conf"
- pipeline.id: vm
  path.config: "/etc/logstash/conf.d/vmlog.conf"

```

vmlog.conf

```auto
input {
	beats {
    port => 5044
    type => 3dlog
  }
}

filter {}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "logs-%{+yyyy.MM.dd}"
  }
}

```

syslog.conf

```auto
input {
  tcp {
    port => 5041
    type => syslog
  }
  udp {
    port => 5041
    type => syslog
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => {
        "message" => [
          "%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:timestamp}|-) +(?:%{HOSTNAME:host_app}|-) +(?:%{NOTSPACE:syslog5424_app}|-) +(?:%{NOTSPACE:syslog5424_proc}|-) - \[(?:%{GREEDYDATA:syslog_tags})\"\] +%{TIMESTAMP_ISO8601:time} +%{LOGLEVEL:logLevel} +%{INT:logLevelNo} +%{GREEDYDATA:scheduling}] +%{GREEDYDATA:logMessage}",
          "(?:%{HOSTNAME:host_app}|-) +(?:%{NOTSPACE:syslog5424_app}|-) +(?:%{NOTSPACE:syslog5424_proc}|-) +(?:%{NOTSPACE}|) \[(?:%{GREEDYDATA:syslog_tags})\"\] +(?:%{HOSTNAME:app_host}) +(?:%{NOTSPACE}|) +(?:%{GREEDYDATA:logMessage})",
          "%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA:logMessage}"
        ]
      }
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
    kv {
      source => "syslog_tags"
      field_split => " "
      value_split => "="
      remove_char_key => "<>\[\],"
      remove_char_value => "<>\[\],"
      trim_key => "<>\[\],"
      trim_value => "<>\[\],"
      include_brackets => false
    }
    if !("_grokparsefailure" in [tags]) {
      mutate {
        rename => ["source_host", "syslog_hostname"]
        rename =>["message", "syslog_message"]
      }
    }
    mutate {
      remove_field => ["syslog_hostname", "syslog_message", "syslog_tags", "syslog_timestamp"]
    }
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "app-logs-%{+yyyy.MM.dd}"
  }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020)._