Multiple beats input ports allowed on Logstash configuration?

Question

I'm trying to achieve getting Logstash to listen to 2 different beats ports - one for filebeat and one for winlogbeat, by setting the conf file to be -

input {
  beats {
    id => "winlogbeat_plugin"
    port => 5044
  }
  beats {
    id => "filebeat_plugin"
    port => 5045
  }
}

But it seems, when the container is created out of this logstash image, it only shows 5044 being listened to, in the netstat -an listing

Can Logstash only listen to 1 beats input at a time? Is there a downside to let both filebeat and winlogbeat send events to SingleIP:SinglePort for Logstash in their own configs?

Answer 1

Logstash can listen to all ports which are free at the time of starting the process. And it can have as much inputs of that type as you can handle with your resources.

There is no real downside for ingesting them in the same input unless you want to be able to make a difference in the pipeline between them (maybe you better use separate pipelines then...)