Auditbeat with multiple outputs


#1

Can users configure Auditbeat to have multiple outputs? For example one output Elasticsearch and one output the file system. It appears that's not possible.


(Carlos PĂ©rez Aradros) #2

Hi @data_smith,

Beats don't support multiple outputs, you would need to use Logstash to send your events them and do some routing to everywhere you need.

As a workaround, you could also send Auditbeat events to the file output, and use Filebeat to forward them to Elasticsearch.

Best regards


#3

OK Thanks