title: Configure Logstash to receive multiple beats
body: <p>I setup an ELK for centralize logging which will receive logs throw filebeat from multiple system and show them on Kibana, I configured logstash to received data from single beat. But i am unable to configure logstash to receive data from multiple beat and show the indexes with different names on kibana. Here is my logstash and filebeat configurations are attached.</p>
  <p><strong>Filebeat</strong></p>
  <pre><code>    ###################### Filebeat Configuration Example #########################
  
  # This file is an example configuration file highlighting only the most common
  # options. The filebeat.reference.yml file from the same directory contains all the
  # supported options with more comments. You can use it as a reference.
  #
  # You can find the full configuration reference here:
  # https://www.elastic.co/guide/en/beats/filebeat/index.html
  
  # For more available modules and options, please see the filebeat.reference.yml sample
  # configuration file.
  
  # ============================== Filebeat inputs ===============================
  
  filebeat.inputs:
  
  # Each - is an input. Most options can be set at the input level, so
  # you can use different inputs for various configurations.
  # Below are the input specific configurations.
  
  - type: log
  
    # Change to true to enable this input configuration.
    enabled: true
  
    # Paths that should be crawled and fetched. Glob based paths.
    paths:
      - /var/log/*.log
      #- c:\programdata\elasticsearch\logs\*
    tags: [&quot;test&quot;]
    fields: {log_type: test}
    # Exclude lines. A list of regular expressions to match. It drops the lines that are
    # matching any regular expression from the list.
    #exclude_lines: ['^DBG']
  
    # Include lines. A list of regular expressions to match. It exports the lines that are
    # matching any regular expression from the list.
    #include_lines: ['^ERR', '^WARN']
  
    # Exclude files. A list of regular expressions to match. Filebeat drops the files that
    # are matching any regular expression from the list. By default, no files are dropped.
    #exclude_files: ['.gz$']
  
    # Optional additional fields. These fields can be freely picked
    # to add additional information to the crawled log files for filtering
    #fields:
    #  level: debug
    #  review: 1
  
    ### Multiline options
  
    # Multiline can be used for log messages spanning multiple lines. This is common
    # for Java Stack Traces or C-Line Continuation
  
    # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
    #multiline.pattern: ^\[
  
    # Defines if the pattern set under pattern should be negated or not. Default is false.
    #multiline.negate: false
  
    # Match can be set to &quot;after&quot; or &quot;before&quot;. It is used to define if lines should be append to a pattern
    # that was (not) matched before or after or as long as a pattern is not matched based on negate.
    # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
    #multiline.match: after
  
  # filestream is an experimental input. It is going to replace log input in the future.
  - type: filestream
  
    # Change to true to enable this input configuration.
    enabled: false
  
    # Paths that should be crawled and fetched. Glob based paths.
    paths:
      - /var/log/*.log
      #- c:\programdata\elasticsearch\logs\*
  
    # Exclude lines. A list of regular expressions to match. It drops the lines that are
    # matching any regular expression from the list.
    #exclude_lines: ['^DBG']
  
    # Include lines. A list of regular expressions to match. It exports the lines that are
    # matching any regular expression from the list.
    #include_lines: ['^ERR', '^WARN']
  
    # Exclude files. A list of regular expressions to match. Filebeat drops the files that
    # are matching any regular expression from the list. By default, no files are dropped.
    #prospector.scanner.exclude_files: ['.gz$']
  
    # Optional additional fields. These fields can be freely picked
    # to add additional information to the crawled log files for filtering
    #fields:
    #  level: debug
    #  review: 1
  
  # ============================== Filebeat modules ==============================
  
  filebeat.config.modules:
    # Glob pattern for configuration loading
    path: ${path.config}/modules.d/*.yml
  
    # Set to true to enable config reloading
    reload.enabled: false
  
    # Period on which files under path should be checked for changes
    #reload.period: 10s
  
  # ======================= Elasticsearch template setting =======================
  
  setup.template.settings:
    index.number_of_shards: 1
    #index.codec: best_compression
    #_source.enabled: false
  
  
  # ================================== General ===================================
  
  # The name of the shipper that publishes the network data. It can be used to group
  # all the transactions sent by a single shipper in the web interface.
  #name:
  
  # The tags of the shipper are included in their own field with each
  # transaction published.
  #tags: [&quot;service-X&quot;, &quot;web-tier&quot;]
  
  # Optional fields that you can specify to add additional information to the
  # output.
  #fields:
  #  env: staging
  
  # ================================= Dashboards =================================
  # These settings control loading the sample dashboards to the Kibana index. Loading
  # the dashboards is disabled by default and can be enabled either by setting the
  # options here or by using the `setup` command.
  dashboards.enabled: true
  
  # The URL from where to download the dashboards archive. By default this URL
  # has a value which is computed based on the Beat name and version. For released
  # versions, this URL points to the dashboard archive on the artifacts.elastic.co
  # website.
  #setup.dashboards.url:
  
  # =================================== Kibana ===================================
  
  # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
  # This requires a Kibana endpoint configuration.
  #setup.kibana:
  
    # Kibana Host
    # Scheme and port can be left out and will be set to the default (http and 5601)
    # In case you specify and additional path, the scheme is required: http://localhost:5601/path
    # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
    #host: &quot;x.x.x.x:5601&quot;
  
    # Kibana Space ID
    # ID of the Kibana Space into which the dashboards should be loaded. By default,
    # the Default Space will be used.
    # space.id:
    #username: &quot;elastic&quot;
      #password: &quot;click123&quot;
  
  # =============================== Elastic Cloud ================================
  
  # These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/).
  
  # The cloud.id setting overwrites the `output.elasticsearch.hosts` and
  # `setup.kibana.host` options.
  # You can find the `cloud.id` in the Elastic Cloud web UI.
  #cloud.id:
  
  # The cloud.auth setting overwrites the `output.elasticsearch.username` and
  # `output.elasticsearch.password` settings. The format is `&lt;user&gt;:&lt;pass&gt;`.
  #cloud.auth:
  
  # ================================== Outputs ===================================
  
  # Configure what output to use when sending the data collected by the beat.
  
  # ---------------------------- Elasticsearch Output ----------------------------
  #output.elasticsearch:
    # Array of hosts to connect to.
    #  hosts: [&quot;localhost:9200&quot;]
  
    # Protocol - either `http` (default) or `https`.
    #protocol: &quot;https&quot;
  
    # Authentication credentials - either API key or username/password.
    #api_key: &quot;id:api_key&quot;
    #username: &quot;elastic&quot;
    #password: &quot;changeme&quot;
  
  # ------------------------------ Logstash Output -------------------------------
  output.logstash:
    # The Logstash hosts
      hosts: [&quot;x.x.x.x:5044&quot;]
  
    # Optional SSL. By default is off.
    # List of root certificates for HTTPS server verifications
    #ssl.certificate_authorities: [&quot;/etc/pki/root/ca.pem&quot;]
  
    # Certificate for SSL client authentication
    #ssl.certificate: &quot;/etc/pki/client/cert.pem&quot;
  
    # Client Certificate Key
    #ssl.key: &quot;/etc/pki/client/cert.key&quot;
      username: &quot;logstash_system&quot;
      password: &quot;click123&quot;
  # ================================= Processors =================================
  processors:
    - add_host_metadata:
        when.not.contains.tags: forwarded
    - add_cloud_metadata: ~
    - add_docker_metadata: ~
    - add_kubernetes_metadata: ~
  
  # ================================== Logging ===================================
  
  # Sets log level. The default log level is info.
  # Available log levels are: error, warning, info, debug
  #logging.level: debug
  
  # At debug level, you can selectively enable logging only for some components.
  # To enable all selectors use [&quot;*&quot;]. Examples of other selectors are &quot;beat&quot;,
  # &quot;publisher&quot;, &quot;service&quot;.
  #logging.selectors: [&quot;*&quot;]
  
  # ============================= X-Pack Monitoring ==============================
  # Filebeat can export internal metrics to a central Elasticsearch monitoring
  # cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The
  # reporting is disabled by default.
  
  # Set to true to enable the monitoring reporter.
  #monitoring.enabled: false
  
  # Sets the UUID of the Elasticsearch cluster under which monitoring data for this
  # Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
  # is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
  #monitoring.cluster_uuid:
  
  # Uncomment to send the metrics to Elasticsearch. Most settings from the
  # Elasticsearch output are accepted here as well.
  # Note that the settings should point to your Elasticsearch *monitoring* cluster.
  # Any setting that is not set is automatically inherited from the Elasticsearch
  # output configuration, so if you have the Elasticsearch output configured such
  # that it is pointing to your Elasticsearch monitoring cluster, you can simply
  # uncomment the following line.
  #monitoring.elasticsearch:
  
  # ============================== Instrumentation ===============================
  
  # Instrumentation support for the filebeat.
  #instrumentation:
      # Set to true to enable instrumentation of filebeat.
      #enabled: false
  
      # Environment in which filebeat is running on (eg: staging, production, etc.)
      #environment: &quot;&quot;
  
      # APM Server hosts to report instrumentation results to.
      #hosts:
      #  - http://localhost:8200
  
      # API Key for the APM Server(s).
      # If api_key is set then secret_token will be ignored.
      #api_key:
  
      # Secret token for the APM Server(s).
      #secret_token:
  
  
  # ================================= Migration ==================================
  
  # This allows to enable 6.7 migration aliases
  #migration.6_to_7.enabled: true
  </code></pre>
  <p><strong>Logstash</strong></p>
  <pre><code>    input {
    beats {
      port =&gt; 5044
    }
  }
  
  # Used to parse syslog messages and send it to Elasticsearch for storing
  
  filter {
    if [log_type] == &quot;test&quot; {
       grok {
          match =&gt; { &quot;message&quot; =&gt; &quot;%{SYSLOGLINE}&quot; }
    }
       date {
          match =&gt; [ &quot;timestamp&quot;, &quot;MMM  d HH:mm:ss&quot;, &quot;MMM dd HH:mm:ss&quot; ]
       }
    }
  }
  # Specify an Elastisearch instance
  
  output {
    elasticsearch {
      hosts =&gt; [&quot;x.x.x.x:9200&quot;]
      user =&gt; &quot;elastic&quot;
      password =&gt; &quot;click123&quot;
      index =&gt; &quot;index-%{[beat.version]}-%{[fields.type]:other}-%{+yyyy.MM.dd}&quot;
    }
  }
  </code></pre>