<p>So still not benchmarked much, but after a quick code inspection and a bunch of reading about netty and logstash in version 5 the input is not the bottleneck to worry about.</p>

<p>Logstash team did put a bunch of work in the way the filters and outputs plugins are run in parallel, the beats input plugin wait for a batch of events, and the performances problem have indeed been solved in version 3.1.0 by the rewrite I quoted in the question.</p>

CC BY-SA 3.0
2017-03-29T15:35:54.363Z
2017-03-29T15:35:54.363Z
Tensibai
<p>After some researches around the <code>beats</code> input plugin and specially <a href="https://github.com/logstash-plugins/logstash-input-beats/issues/92" rel="noreferrer">this rewrite</a> I wonder if I should use only one beat input or multiples to handle multiples entry types.</p>

<p>I'll have events coming from roughly 500 machines, with a 20/80 windows/linux distribution. I plan to use multiples <a href="https://www.elastic.co/products/beats" rel="noreferrer">beats shipper</a>, filebeat, metricbeat and maybe packetbeat.</p>

<p>Is there an interest at using one input per type/os couple or would just one input and "if type=..." in the filter pipeline be enough ?</p>

<architecture><performance><logstash>
Should I use multiple beats input in Logstash?
Tensibai
# Should I use multiple beats input in Logstash?

(Asked by: username_0 on 2017-03-17)

After some researches around the `beats` input plugin and specially [this rewrite](https://github.com/logstash-plugins/logstash-input-beats/issues/92) I wonder if I should use only one beat input or multiples to handle multiples entry types.

I'll have events coming from roughly 500 machines, with a 20/80 windows/linux distribution. I plan to use multiples [beats shipper](https://www.elastic.co/products/beats), filebeat, metricbeat and maybe packetbeat.

Is there an interest at using one input per type/os couple or would just one input and "if type=..." in the filter pipeline be enough ?

**Tags:** architecture, performance, logstash


---

## 1 answers

### Answer by username_0 on 2017-03-29. Score: 6 | Accepted answer

So still not benchmarked much, but after a quick code inspection and a bunch of reading about netty and logstash in version 5 the input is not the bottleneck to worry about.

Logstash team did put a bunch of work in the way the filters and outputs plugins are run in parallel, the beats input plugin wait for a batch of events, and the performances problem have indeed been solved in version 3.1.0 by the rewrite I quoted in the question.


---

