Logstash multiple pipelines going into same index I'm trying to set up a centralized syslog for multiple log sources.

So I have a logstash that has two separate inputs and two separate outputs

However for some reason the data from one of the inputs ends up in both indexes

What am i doing wrong?

Below are both pipelines' configs

input {
  tcp {
    port =&gt; 5052
    codec =&gt; "json_lines"
  }
}
output {
  elasticsearch {
    hosts =&gt; "10.50.6.116"
    index =&gt; "remote"
  }
  file {
    path =&gt; "/var/log/logstash/remote-tcp.log"
  }
  stdout { codec =&gt; rubydebug }
}

input {
  file {
    path =&gt; "/data/vmlist/*.csv"
    start_position =&gt; "beginning"
    sincedb_path =&gt; "/tmp/sincedb"
  }
}
filter {
  csv {
    separator =&gt; ","
    columns =&gt; ["VM Name","Creation Date","Owner","Type","Message"]
  }
}
output {
  elasticsearch {
    hosts =&gt; "http://10.50.6.116:9200"
    index =&gt; "vms"
    document_type =&gt; "csv"
  }
  stdout{ codec=&gt; rubydebug}
}
There are two ways to accomplish this, though one of them was only available recently.

The old-school version, the one you can do as far back as Logstash 1.5, is to pay attention to tags and use conditionals to separate your inputs. Roughly...

input {
  tcp {
    port =&gt; 1525
    codec =&gt; json_lines
    tags =&gt; [ 'tcp' ]
  }
}

input {
  file {
    path =&gt; '/var/log/app.log'
    codec =&gt; 'json'
    tags =&gt; [ 'file' ]
  }
}

output {
  if 'file' in [tags] {
    elasticsearch {
      host =&gt; 'logstash-es'
      index =&gt; 'files'
    }
  }
  if 'tcp' in [tags] {
    elasticsearch {
      host =&gt; 'logstash-es'
      index =&gt; 'tcp'
    }
  }
}


This results in two inputs that output to two separate outputs. This is all one file, though. Elastic figured out people were muxing pipelines this way, and came up with a way to do multiple pipelines in separate files.

- pipeline.id: tcp-inputs
  path.config: '/etc/logstash/pipelines/tcp.cfg'
  pipeline.workers: 3
- pipeline.id: file-inputs
  path.config: '/etc/logstash/pipelines/files.cfg'
  pipeline.workers: 2


This approach is somewhat more maintainable since the pipelines are in separate files, and humans don't have to reason out how the flows work when presented in a single big file. Pipelines are available in Logstash 6.0 and newer.