2 instance filebeat reading the same file

Hi, I am using Elastic Kibana and filebeat to read and monitor my docker container (docker stack) logs. for compagnie policy reason I need to send the logs at 2 elasticsearch locations (the project instance and the compagnie standard instance).

I read that filebeat allow only one output. So here is my question, is it possible to run 2 filebeats instances on the same server reading the same log files but with 2 differents output ?

thank you for your time and anwser :slight_smile:

It is possible, but you cannot use the provided packages. You'll have to build from source and make sure you have separate data, config and service.

thx i'll try that

I'm running multiple filebeats on the same host using debian packages:

create the extra data dir:
mkdir /var/lib/filebeat-other

create the extra log dir:
mkdir /var/log/filebeat-other

copy the systemd service file:
cp /usr/lib/systemd/system/filebeat.service /usr/lib/systemd/system/filebeat-other.service

copy the filebeat config file:
cp /etc/filebeat/filebeat.yml /etc/filebeat/filebeat-other.yml

edit the systemd service file:
sed -i 's/filebeat.yml/filebeat-other.yml/' /usr/lib/systemd/system/filebeat-other.service
sed -i 's/lib\/filebeat/lib\/filebeat-other/' /usr/lib/systemd/system/filebeat-other.service
sed -i 's/log\/filebeat/log\/filebeat-other/' /usr/lib/systemd/system/filebeat-other.service

reload systemd config:
systemctl daemon-reload

enable new service:
systemctl enable filebeat-other

start new service:
systemctl start filebeat-other

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.