Answers: <p>So still not benchmarked much, but after a quick code inspection and a bunch of reading about netty and logstash in version 5 the input is not the bottleneck to worry about.</p>
  
  <p>Logstash team did put a bunch of work in the way the filters and outputs plugins are run in parallel, the beats input plugin wait for a batch of events, and the performances problem have indeed been solved in version 3.1.0 by the rewrite I quoted in the question.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-03-29T15:35:54.363Z
Answers: 2017-03-29T15:35:54.363Z
Answers: Tensibai
Body: <p>After some researches around the <code>beats</code> input plugin and specially <a href="https://github.com/logstash-plugins/logstash-input-beats/issues/92" rel="noreferrer">this rewrite</a> I wonder if I should use only one beat input or multiples to handle multiples entry types.</p>
  
  <p>I'll have events coming from roughly 500 machines, with a 20/80 windows/linux distribution. I plan to use multiples <a href="https://www.elastic.co/products/beats" rel="noreferrer">beats shipper</a>, filebeat, metricbeat and maybe packetbeat.</p>
  
  <p>Is there an interest at using one input per type/os couple or would just one input and "if type=..." in the filter pipeline be enough ?</p>
  
Tags: <architecture><performance><logstash>
Title: Should I use multiple beats input in Logstash?
UserDisplayName: Tensibai
ThreadText: # Should I use multiple beats input in Logstash?
  
  (Asked by: username_0 on 2017-03-17)
  
  After some researches around the `beats` input plugin and specially [this rewrite](https://github.com/logstash-plugins/logstash-input-beats/issues/92) I wonder if I should use only one beat input or multiples to handle multiples entry types.
  
  I'll have events coming from roughly 500 machines, with a 20/80 windows/linux distribution. I plan to use multiples [beats shipper](https://www.elastic.co/products/beats), filebeat, metricbeat and maybe packetbeat.
  
  Is there an interest at using one input per type/os couple or would just one input and "if type=..." in the filter pipeline be enough ?
  
  **Tags:** architecture, performance, logstash
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2017-03-29. Score: 6 | Accepted answer
  
  So still not benchmarked much, but after a quick code inspection and a bunch of reading about netty and logstash in version 5 the input is not the bottleneck to worry about.
  
  Logstash team did put a bunch of work in the way the filters and outputs plugins are run in parallel, the beats input plugin wait for a batch of events, and the performances problem have indeed been solved in version 3.1.0 by the rewrite I quoted in the question.
  
  
  ---
  
  