# Two file output in Logstash
**URL:** https://discuss.elastic.co/t/two-file-output-in-logstash/319056
**Category:** Logstash
**Created:** [November 16, 2022, 10:27am UTC](https://discuss.elastic.co/t/two-file-output-in-logstash/319056 "2022-11-16T10:27:03Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Vrops](https://discuss.elastic.co/u/Vrops)
#### Post date: [November 16, 2022, 10:27am UTC](https://discuss.elastic.co/t/two-file-output-in-logstash/319056/1 "2022-11-16T10:27:04Z")
Hello,
I have explored several forums but can't find any answers to my question.
I'm trying to get 2 Filebeat inputs and redirect them via Logstash with 2 different file outputs.
Here are my configuration files:
filebeat.yml:
```auto
# ============================== Filebeat inputs ===============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
# filestream is an input for collecting log messages from files.
- type: filestream
# Unique ID among all inputs, an ID is required.
id: ID1
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
tags: ["tag1"]
paths:
- /var/log/site1/access.log
#- c:\programdata\elasticsearch\logs\*
- type: filestream
id: ID2
enabled: true
tags: ["tag2"]
paths:
- /var/log/site2/access.log
```
Logstash.config:
```auto
input {
beats {
port => 5044
}
}
filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
date {
match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
mutate {
convert => {
"response" => "integer"
"bytes" => "integer"
}
}
}
output {
if "tag1" in [tags]{
stdout { codec => rubydebug }
file {
path => "/var/central-log/Output1.log"
}
}
else if "tag2" in [tags]{
stdout { codec => rubydebug }
file {
path => "/var/central-log/Output2.log"
}
}
}
```
Is this the right method? Can you help me?
Thank you,
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [November 17, 2022, 11:50am UTC](https://discuss.elastic.co/t/two-file-output-in-logstash/319056/2 "2022-11-17T11:50:50Z")
Yes,this is it. Do you have any problems?
---
### Author:  [@Vrops](https://discuss.elastic.co/u/Vrops)
#### Post date: [November 17, 2022, 12:58pm UTC](https://discuss.elastic.co/t/two-file-output-in-logstash/319056/3 "2022-11-17T12:58:37Z")
Yes, I have don't have error messages but nothing happens in logstash server.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 17, 2022, 4:51pm UTC](https://discuss.elastic.co/t/two-file-output-in-logstash/319056/4 "2022-11-17T16:51:52Z")
I suggest you add an unconditional else with a third file output and see if the events really have the [tags] that you expect.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [November 17, 2022, 10:07pm UTC](https://discuss.elastic.co/t/two-file-output-in-logstash/319056/5 "2022-11-17T22:07:51Z")
Just to add to Badger, you can add rubydebug on the top of output for better diagnostic.
```auto
output {
stdout { codec => rubydebug }
if "tag1" in [tags]{
...
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 15, 2022, 10:08pm UTC](https://discuss.elastic.co/t/two-file-output-in-logstash/319056/6 "2022-12-15T22:08:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.