# Take input from more than 5 servers

**URL:** <https://discuss.elastic.co/t/take-input-from-more-than-5-servers/95330>\
**Category:** Logstash\
**Created:** [August 1, 2017, 11:40am UTC](https://discuss.elastic.co/t/take-input-from-more-than-5-servers/95330 "2017-08-01T11:40:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [August 1, 2017, 11:40am UTC](https://discuss.elastic.co/t/take-input-from-more-than-5-servers/95330/1 "2017-08-01T11:40:29Z")

</div>

I am new to ELK  
Pls Help  
As i have to observe 5 different Servers(5 metricbeat & 5 Filebeat) on ec2 instance . Than do i need to run different logstash config. file or i can take input in a single logstash file and run it?  
and also do i need to create different cluster for each server?

Thanks & Regards  
Shrikant

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 1, 2017, 7:30pm UTC](https://discuss.elastic.co/t/take-input-from-more-than-5-servers/95330/2 "2017-08-01T19:30:12Z")

</div>

You can have only one logstash instance for receive the data from the 5 different servers.

On your logstash you will have an input like this.

```auto
input {
  beats {
    port => 5044
  }
}

```

And in each one of your servers you will configure your beats to output to the same logstash server.

```auto
output.logstash:
  hosts: ["your-logstash-server:5044"]

```

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [August 2, 2017, 1:26am UTC](https://discuss.elastic.co/t/take-input-from-more-than-5-servers/95330/3 "2017-08-02T01:26:31Z")

</div>

Greetings thankyou for your reply  
Than how will we be able to create different index for all the 5 Servers.  
As I want to create different dashboard for each server.  
What should be the output of logstash for this?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 2, 2017, 2:16am UTC](https://discuss.elastic.co/t/take-input-from-more-than-5-servers/95330/4 "2017-08-02T02:16:43Z")

</div>

For each one of your servers you can define a type in the beats configuration, than in your logstash pipeline, in the filter and output blocks, you will need to use conditionals to direct each input to its own output.

For example, in a filebeat configuration you will have something like this:

```auto
filebeat:
 prospectors:
  - input_type: log
    paths:
     - C:\inetpub\logs\LogFiles\W3SVC1\*.log
    fields:
      document_type: server01-type

```

Then in your logstash pipeline you will have something like this:

```auto
filter {
    if [type] == "server01-type" {
        your filters
    }
}
output {
    if [type] == "server01-type" {
        elasticsearch {
        hosts => ["localhost:9200"]
        index => "server01-%{+YYYY.MM.dd}"
        document_type => "server01-type"
        template_name => "server01-template"
       }
    }
}

```

You can read more about conditionals [here](https://www.elastic.co/guide/en/logstash/5.5/config-examples.html#using-conditionals)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 2, 2017, 1:07pm UTC](https://discuss.elastic.co/t/take-input-from-more-than-5-servers/95330/5 "2017-08-02T13:07:22Z")

</div>

Instead of using conditionals, you should get a `host` field with the name of the host that collected the event, in which case you can reference that field in your single elasticsearch output:

```nohighlight
elasticsearch {
  hosts => ["localhost:9200"]
  index => "%{host}-%{+YYYY.MM.dd}"
  document_type => "%{host}-type"
  template_name => "%{host}-template"
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2017, 1:07pm UTC](https://discuss.elastic.co/t/take-input-from-more-than-5-servers/95330/6 "2017-08-30T13:07:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.