Logstash multiple pipelines going into same index
There are two ways to accomplish this, though one of them was only available recently.

The old-school version, the one you can do as far back as Logstash 1.5, is to pay attention to tags and use conditionals to separate your inputs. Roughly...

input {
  tcp {
    port =&gt; 1525
    codec =&gt; json_lines
    tags =&gt; [ 'tcp' ]
  }
}

input {
  file {
    path =&gt; '/var/log/app.log'
    codec =&gt; 'json'
    tags =&gt; [ 'file' ]
  }
}

output {
  if 'file' in [tags] {
    elasticsearch {
      host =&gt; 'logstash-es'
      index =&gt; 'files'
    }
  }
  if 'tcp' in [tags] {
    elasticsearch {
      host =&gt; 'logstash-es'
      index =&gt; 'tcp'
    }
  }
}


This results in two inputs that output to two separate outputs. This is all one file, though. Elastic figured out people were muxing pipelines this way, and came up with a way to do multiple pipelines in separate files.

- pipeline.id: tcp-inputs
  path.config: '/etc/logstash/pipelines/tcp.cfg'
  pipeline.workers: 3
- pipeline.id: file-inputs
  path.config: '/etc/logstash/pipelines/files.cfg'
  pipeline.workers: 2


This approach is somewhat more maintainable since the pipelines are in separate files, and humans don't have to reason out how the flows work when presented in a single big file. Pipelines are available in Logstash 6.0 and newer.