title: Logstash syslog input from nginx
body: <p>I have a ELK server, and receive logs from remote nginx servers.
  I created two logstash configuration files, for different inputs.
  Firs config listen to 5140 port` </p>
  
  <pre><code>input {
    syslog {
          host =&gt; "0.0.0.0"
          port =&gt; 5140
          timezone =&gt; "CET"
          tags =&gt; "test-server-nginx"
          type =&gt; "log"
          }
    }
  
  filter {
  grok {
     match =&gt; [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
     overwrite =&gt; [ "message" ]
  }
  geoip {
     source =&gt; "clientip"
  }
  
  mutate {
     convert =&gt; ["response", "integer"]
     convert =&gt; ["bytes", "integer"]
     convert =&gt; ["responsetime", "float"]
  }
  
  date {
     match =&gt; [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
  }
  
  useragent {
     source =&gt; "agent"
      }
  }
  
  output {
    elasticsearch {
      hosts =&gt; ["http://localhost:9200"]
      index =&gt; "test-nginx-%{+YYYY.MM.dd}"
    }
  }
  </code></pre>
  
  <p>nginx config is: </p>
  
  <pre><code> access_log syslog:server=my-elk.com:5140,tag=nginx_front_nginx_access;
  </code></pre>
  
  <p>Second logstash configuration is:</p>
  
  <pre><code>input {
    syslog {
          host =&gt; "0.0.0.0"
          port =&gt; 5150
          timezone =&gt; "UTC"
          tags =&gt; "aws-nginx"
          type =&gt; "log"
          }
    }
  
  filter {
  grok {
     match =&gt; [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
     overwrite =&gt; [ "message" ]
  }
  geoip {
     source =&gt; "clientip"
  }
  
  mutate {
     convert =&gt; ["response", "integer"]
     convert =&gt; ["bytes", "integer"]
     convert =&gt; ["responsetime", "float"]
  }
  
  date {
     match =&gt; [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
  }
  
  useragent {
     source =&gt; "agent"
      }
  }
  
  output {
    elasticsearch {
      hosts =&gt; ["http://localhost:9200"]
      index =&gt; "aws-nginx-%{+YYYY.MM.dd}"
    }
  }
  </code></pre>
  
  <p>And nginx for this:</p>
  
  <pre><code>access_log syslog:server=my-elk.com:5150,tag=bk_nginx_access;
  </code></pre>
  
  <p>I see the input traffic over port via </p>
  
  <pre><code>tcpdump 'port 5140' (and 5150)
  </code></pre>
  
  <p>all work fine, i see that the packets is coming.</p>
  
  <p>But when i create a kibana index, and loog to the firs pattern, i see that the two indexes are mixed. 
  <a href="https://i.stack.imgur.com/DdlG4.png" rel="nofollow noreferrer">First config index</a></p>
  
  <p><a href="https://i.stack.imgur.com/ZGmSt.png" rel="nofollow noreferrer">Second config index</a></p>
  
  <p>Please help.
  Im also tried use input udp plugin, but no result.
  Thank you.</p>