# Run multiple logstash instances vs. one instance?

**URL:** https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141
**Category:** Logstash
**Created:** [March 1, 2016, 5:49pm UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141 "2016-03-01T17:49:08Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [March 1, 2016, 5:49pm UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141/1 "2016-03-01T17:49:08Z")

</div>

Hi All,

I have the following Logstash config

```auto
input {	
	# Receive logs
       tcp {
		port => 5544
		type => "iis"
	} 

	tcp {
		port => 5545
		type => "perfmon"
	} 
}
filter {}

output {
       if [type] == "iis" {
	elasticsearch {
		hosts => ["192.168.1.10:9200"]
		index => "iis-%{+YYYY.MM.dd}"
	}

       if [type] == "perfmon" {
	elasticsearch {
		hosts => ["192.168.1.10:9200"]
		index => "perfmon-%{+YYYY.MM.dd}"
	}
}

```

My question is that will using if to check types and route data to different indexes significantly affect throughput?  
Should I instead run 2 Logstash instances -one listens on 5544 for iis, and the other listens on 5545 for perfmon?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 1, 2016, 9:14pm UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141/2 "2016-03-01T21:14:37Z")

</div>

What sort of rates are you expecting to be processing?

---

<div class="post-metadata">

### Author: ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [March 1, 2016, 10:30pm UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141/3 "2016-03-01T22:30:45Z")

</div>

Hi Mark,

At least 5000 messages per second.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 1, 2016, 11:53pm UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141/4 "2016-03-01T23:53:56Z")

</div>

You should be able to handle that with a single instance.

---

<div class="post-metadata">

### Author: ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [March 1, 2016, 11:55pm UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141/5 "2016-03-01T23:55:25Z")

</div>

Thanks, I'll try with one instance.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:08am UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141/6 "2017-07-06T05:08:58Z")

</div>


