# Send different input to the graylog using filebeats

**URL:** <https://community.graylog.org/t/send-different-input-to-the-graylog-using-filebeats/29744>\
**Category:** Graylog Central (peer support)\
**Created:** [August 4, 2023, 4:10am UTC](https://community.graylog.org/t/send-different-input-to-the-graylog-using-filebeats/29744 "2023-08-04T04:10:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bruleeyo](https://avatars.discourse-cdn.com/v4/letter/b/cc9497/32.png) [@bruleeyo](https://community.graylog.org/u/bruleeyo)\
**Post date:** [August 4, 2023, 4:10am UTC](https://community.graylog.org/t/send-different-input-to-the-graylog-using-filebeats/29744/1 "2023-08-04T04:10:49Z")

</div>

I want to send 3 input to the graylog using filebeats, which are: auth.log, access.log, and error.log. and i want to differentiate them into 3 output in graylog, with 3 different port ( i have 1 server graylog). so i have 3 different input in graylog. i have tried this configuration but it doesnt appear any logs:

filebeat.yml

```auto
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /path/auth.log
    fields:
      log_type: auth_logs
    fields_under_root: true

  - type: log
    enabled: true
    paths:
      - /path/access.log
    fields:
      log_type: access_logs
    fields_under_root: true

  - type: log
    enabled: true
    paths:
      - /path/error.log
    fields:
      log_type: error_logs
    fields_under_root: true

output:
  if:
    equals:
      log_type: "auth_logs"
  logstash:
    host: graylog_server_ip
    port: 12201

  else if:
    equals:
      log_type: "access_logs"
  logstash:
    host: graylog_server_ip
    port: 12202

  else if:
    equals:
      log_type: "error_logs"
  logstash:
    host: graylog_server_ip
    port: 12203

  else:
    logstash:
      host: graylog_server_ip
      port: 12204

```

in graylog inputs, i tried to used gelf tcp and beats but both not works. i think the problem is in the output, but i dont know how. please help

---

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [August 4, 2023, 4:22pm UTC](https://community.graylog.org/t/send-different-input-to-the-graylog-using-filebeats/29744/2 "2023-08-04T16:22:06Z")

</div>

Beats is the input type you will want to use, by why are you wanting to send them in seperately, you can just use pipelines to route them once they are in graylog even on the same input?

---

<div class="post-metadata">

**Author:** ![bruleeyo](https://avatars.discourse-cdn.com/v4/letter/b/cc9497/32.png) [@bruleeyo](https://community.graylog.org/u/bruleeyo)\
**Post date:** [August 7, 2023, 6:14am UTC](https://community.graylog.org/t/send-different-input-to-the-graylog-using-filebeats/29744/3 "2023-08-07T06:14:52Z")

</div>

i want to differentiate those logs (in the input graylog), so it would be clearer information. does using pipelines can separate the input logs in graylog?

---

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [August 10, 2023, 11:57am UTC](https://community.graylog.org/t/send-different-input-to-the-graylog-using-filebeats/29744/4 "2023-08-10T11:57:00Z")

</div>

Ya absolutly! The regular way to do it would be to send them all through one input, and then use a pipeline with route\_to\_stream and using the when section of the pipeline to filter the messages you want routed to that location.

Something like  
When  
$message.source == “8.8.8.8”  
Then  
Route\_to\_stream(name: “my stream”, remove\_from\_default: true);  
End

But you can use any supported function in the when section to select the messages.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 24, 2023, 11:57am UTC](https://community.graylog.org/t/send-different-input-to-the-graylog-using-filebeats/29744/5 "2023-08-24T11:57:55Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.