# Working with filebeat and Winlogbeat at the same time

**URL:** <https://discuss.elastic.co/t/working-with-filebeat-and-winlogbeat-at-the-same-time/175209>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [April 3, 2019, 1:37pm UTC](https://discuss.elastic.co/t/working-with-filebeat-and-winlogbeat-at-the-same-time/175209 "2019-04-03T13:37:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Post date:** [April 3, 2019, 1:37pm UTC](https://discuss.elastic.co/t/working-with-filebeat-and-winlogbeat-at-the-same-time/175209/1 "2019-04-03T13:37:32Z")

</div>

Hello,  
So i had configured **Filebeat** to forward data to **Logstash** via port **5044** and data has to go through Grok filter (that contains a **drop** condition )

```
if "_grokparsefailure" in [tags] {
	drop {}
	}

```

it is working fine , and data that correspond to my format was parsed to fields, non conforming formats were dropped.  
Now i added **Winlogbeat** and made it forward data to **logstash** via **the same port 5044** but i receive nothing in winlogbeat when i check in Kibana. My best guess is they are being dropped by my grok filter.  
So is there a way to make it skip the grok filter like making it forward data through a seperate port or something.  
Any help will be apperciated.

---

<div class="post-metadata">

**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Post date:** [April 4, 2019, 9:20am UTC](https://discuss.elastic.co/t/working-with-filebeat-and-winlogbeat-at-the-same-time/175209/2 "2019-04-04T09:20:30Z")

</div>

I solved it for who ever crossed this problem , here is the solution :  
-use one port for both winlogbeat and filebeat (they will be tagged automatically )  
-in the filter section :

```
filter {
		if "wineventlog" in [type]{ }
		if "wineventlog" not in [type]{
            *your grok filter here with the drop condition and all* } }

```

Hope this would be helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2019, 9:20am UTC](https://discuss.elastic.co/t/working-with-filebeat-and-winlogbeat-at-the-same-time/175209/3 "2019-05-02T09:20:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.