# Rsyslog + Beats together

**URL:** <https://discuss.elastic.co/t/rsyslog-beats-together/239994>\
**Category:** Logstash\
**Created:** [July 6, 2020, 11:32am UTC](https://discuss.elastic.co/t/rsyslog-beats-together/239994 "2020-07-06T11:32:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![akam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akam/32/71663_2.png) [@akam](https://discuss.elastic.co/u/akam)\
**Post date:** [July 6, 2020, 11:32am UTC](https://discuss.elastic.co/t/rsyslog-beats-together/239994/1 "2020-07-06T11:32:30Z")

</div>

Hello,

I am trying to collect logs from rsyslog and filebeats. I have rsyslog configuration files:  
01-json-template.conf

```auto
    template(name="json-template" type="list") {
        constant(value="{")
        constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
        constant(value="\",\"message\":\"") property(name="msg" format="json")
        constant(value="\",\"hostname\":\"") property(name="hostname")
        constant(value="\",\"programname\":\"") property(name="programname")
        constant(value="\"}\n")
    }

```

10-myservice.conf

```auto
if $syslogtag contains 'myservice' then {
    /var/log/myservice.log
    @@logstash-address:10514;json-template
    stop
}

And I have logstash.conf:
    input {
    <------>tcp {
    <------><------>port => 5000
    <------>}
    }

    input {
        beats {
            port => 5044
            type => "beats"
        }
    }

    input {
       tcp {
            port => 10514
            type => "rsyslog"
        }
    }

    filter {
        json { source => "message" }
        json { source => "log" }
    }

    output {
    <------>elasticsearch {
    <------><------>hosts => "elasticsearch:9200"
    <------><------>user => "elastic"
    <------><------>password => "changeme"
    <------>}
    }

```

With this logstash config, there are no logs from rsyslog. But if I remove input beats(5044), I can see logs from rsyslog in kibana.

So, can these two inputs work together?

---

<div class="post-metadata">

**Author:** ![Jeeth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeeth/32/71724_2.png) [@Jeeth](https://discuss.elastic.co/u/Jeeth)\
**Post date:** [July 7, 2020, 10:49am UTC](https://discuss.elastic.co/t/rsyslog-beats-together/239994/2 "2020-07-07T10:49:28Z")

</div>

multiple inputs in same conf file ?

---

<div class="post-metadata">

**Author:** ![akam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akam/32/71663_2.png) [@akam](https://discuss.elastic.co/u/akam)\
**Post date:** [July 7, 2020, 10:52am UTC](https://discuss.elastic.co/t/rsyslog-beats-together/239994/3 "2020-07-07T10:52:58Z")

</div>

yes, is it wrong?

---

<div class="post-metadata">

**Author:** ![Jeeth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeeth/32/71724_2.png) [@Jeeth](https://discuss.elastic.co/u/Jeeth)\
**Post date:** [July 7, 2020, 10:55am UTC](https://discuss.elastic.co/t/rsyslog-beats-together/239994/4 "2020-07-07T10:55:56Z")

</div>

I think you can specify number of inputs like tcp, beats etc inside one single input plugin  
Ex:

```auto
input {
        beats {
            port => 5044
            type => "beats"
        }
       tcp {
            port => 10514
            type => "rsyslog"
        }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2020, 10:57am UTC](https://discuss.elastic.co/t/rsyslog-beats-together/239994/5 "2020-08-04T10:57:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.