2 instance filebeat reading the same file

[zeO (Zouhair)]

Hi, I am using Elastic Kibana and filebeat to read and monitor my docker container (docker stack) logs. for compagnie policy reason I need to send the logs at 2 elasticsearch locations (the project instance and the compagnie standard instance).

I read that filebeat allow only one output. So here is my question, is it possible to run 2 filebeats instances on the same server reading the same log files but with 2 differents output ?

thank you for your time and anwser

[willemdh]

It is possible, but you cannot use the provided packages. You'll have to build from source and make sure you have separate data, config and service.

[zeO (Zouhair)]

thx i'll try that

[tjfred]

I'm running multiple filebeats on the same host using debian packages:

create the extra data dir:
mkdir /var/lib/filebeat-other

create the extra log dir:
mkdir /var/log/filebeat-other

copy the systemd service file:
cp /usr/lib/systemd/system/filebeat.service /usr/lib/systemd/system/filebeat-other.service

copy the filebeat config file:
cp /etc/filebeat/filebeat.yml /etc/filebeat/filebeat-other.yml

edit the systemd service file:
sed -i 's/filebeat.yml/filebeat-other.yml/' /usr/lib/systemd/system/filebeat-other.service
sed -i 's/lib\/filebeat/lib\/filebeat-other/' /usr/lib/systemd/system/filebeat-other.service
sed -i 's/log\/filebeat/log\/filebeat-other/' /usr/lib/systemd/system/filebeat-other.service

reload systemd config:
systemctl daemon-reload

enable new service:
systemctl enable filebeat-other

start new service:
systemctl start filebeat-other