# Using beats and send logstash

**URL:** https://discuss.elastic.co/t/using-beats-and-send-logstash/67699
**Category:** Beats
**Created:** [December 1, 2016, 2:15am UTC](https://discuss.elastic.co/t/using-beats-and-send-logstash/67699 "2016-12-01T02:15:19Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![bob-bza](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@bob-bza](https://discuss.elastic.co/u/bob-bza)
#### Post date: [December 1, 2016, 2:15am UTC](https://discuss.elastic.co/t/using-beats-and-send-logstash/67699/1 "2016-12-01T02:15:20Z")

</div>

I was new not ELK, sending logs from multiple beats to single logstash with same tag, but was not able to see all the beats hosts in kibana.  
for ex: i was sending 5beats to 1logstash with same tag name. but can see only first beat logs but rest other beats i was not able to see. this was syntax i was using.

input {  
beats {  
port =\> 5044  
tags =\> ["kafka"]  
}  
output {  
if "kafka" in [tags] {  
elasticsearch {  
action =\> "index"  
hosts =\> "elasticsearch:80"  
index =\> "kafka"  
}  
}

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [December 5, 2016, 3:20pm UTC](https://discuss.elastic.co/t/using-beats-and-send-logstash/67699/2 "2016-12-05T15:20:19Z")

</div>

Which beats and logstash version are you using? Which logstash input beats plugin? Have you checked beats and logstash logs?

Why use tags and and `if "kafka" in [tags]` in order to send to "kafka" index? While ok, this pattern doesn't scale this well.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 22, 2016, 2:15am UTC](https://discuss.elastic.co/t/using-beats-and-send-logstash/67699/3 "2016-12-22T02:15:29Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.
