# Azure Module - Multiple event hubs?
**URL:** https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850
**Category:** Beats
**Tags:** filebeat
**Created:** [May 3, 2022, 3:09pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850 "2022-05-03T15:09:23Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@chris.murray](https://discuss.elastic.co/u/chris.murray)
#### Post date: [May 3, 2022, 3:09pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/1 "2022-05-03T15:09:23Z")
Can't seem to find a solution for this. Here's the situation:
I am setting up a PoC environment, which has two Azure event hubs configured to input Azure AD data (which themselves are coming from separate environments).
I have a filebeat instance I'm trying to pull the data in from, and pass off to a Logstash instance to eventually send to ES Cloud.
Filebeat works fine if I set up a single azure module definition, which points to a specific event hub. It doesn't appear I can duplicate the block to point to a second event hub.
What would be the recommended setup to achieve this goal? I'm kind of new to filebeat modules, so I'm not entirely sure if in this instance I even NEED the module, or if plain inputs are fine?
---
### Author:  [@zmoog](https://discuss.elastic.co/u/zmoog)
#### Post date: [May 4, 2022, 4:54pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/2 "2022-05-04T16:54:43Z")
Hey @chris.murray, a couple of questions to test my understanding of your scenario.
Are you trying to pull the same type of data (auditlogs or signinlogs) from two different event hubs / active directories?
Can you share the configuration files from your PoC (even a simplified version would do)?
[Modules](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-azure.html) usually have [one input per data type](https://github.com/elastic/beats/blob/main/x-pack/filebeat/module/azure/auditlogs/manifest.yml), but I want to learn more about your use case before adding more.
---
### Author:  [@chris.murray](https://discuss.elastic.co/u/chris.murray)
#### Post date: [May 5, 2022, 2:51pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/3 "2022-05-05T14:51:08Z")
Yeah, so for the moment assume they are both activitylogs. (The point about the different log types is good, but the setup isn't that far yet...and likely we'd have different ones for the different log types).
I've kind of figured out that the Azure module, if you put two entries in like so:
```auto
filebeat.modules:
# Config for Event Hub 1
- module: azure
activitylogs:
enabled: true
var:
eventhub: "eventhubname"
consumer_group: "$Default"
connection_string: "Endpoint=sb://(rest of connection string)"
storage_account: "(storageaccountname)"
storage_account_key: "(Storageaccountkey)"
# Config for Event Hub 2
- module: azure
activitylogs:
enabled: true
var:
eventhub: "eventhub2name"
consumer_group: "$Default"
connection_string: "Endpoint=sb://(rest of connection string)"
storage_account: "(storageaccountname)"
storage_account_key: "(Storageaccountkey)"
```
The second one will be "active" and the first one ignored. If I flip them around it works.
You might wonder why we're doing this. It's a bit of a multi-tenant environment, and the separate event hubs is part of how this particular client separates data...not something I can directly change 馃槂
What we've done as a bandaid for the moment is have two filebeat agents running on the same box we're pulling these logs from (using different filebeat.yml files / path.data paths) and that does work, but feels a bit clunky. I don't know if this is the recommended way or not.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 6, 2022, 6:17am UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/4 "2022-05-06T06:17:07Z")
Just for a test have you tried to put the 2nd `activitylogs:` in just under the same `- module: azure` definition?
---
### Author:  [@chris.murray](https://discuss.elastic.co/u/chris.murray)
#### Post date: [May 6, 2022, 12:30pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/5 "2022-05-06T12:30:02Z")
I have not....will test.
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [May 8, 2022, 9:37pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/6 "2022-05-08T21:37:35Z")
That won't work. What version of beats are u using? This was a bug that was fixed. There was a bug with how the `filebeat.modules` section was parsed. If u copy the config that u have to the `modules.d/azure.yml`, it will work as expected
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [May 9, 2022, 1:32am UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/7 "2022-05-09T01:32:01Z")
Should be in filebeat 8.1 or 8.2
---
### Author:  [@zmoog](https://discuss.elastic.co/u/zmoog)
#### Post date: [May 9, 2022, 10:43am UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/8 "2022-05-09T10:43:46Z")
> [@chris.murray](#):
>
> You might wonder why we're doing this. It's a bit of a multi-tenant environment, and the separate event hubs is part of how this particular client separates data...not something I can directly change 馃槂
I think this is a legit use case.
> This was a bug that was fixed.
@legoguy1000 is [Inconsistencies on filebeat modules configuration load 路 Issue #11943 路 elastic/beats 路 GitHub](https://github.com/elastic/beats/issues/11943) the bug you were mentioning?
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [May 9, 2022, 10:56am UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/9 "2022-05-09T10:56:56Z")
That's an older one, here's the PR that fixed it along with a more recent issue mentioning it. [[Filebeat] Fix multiple modules in filebeat.yml by legoguy1000 路 Pull Request #29952 路 elastic/beats 路 GitHub](https://github.com/elastic/beats/pull/29952)
---
### Author:  [@zmoog](https://discuss.elastic.co/u/zmoog)
#### Post date: [May 9, 2022, 11:28am UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/10 "2022-05-09T11:28:35Z")
Oh, great!
According to the release notes, the fix has been [released in 8.0.1](https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-8.0.1.html).
---
### Author:  [@chris.murray](https://discuss.elastic.co/u/chris.murray)
#### Post date: [May 9, 2022, 12:41pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/11 "2022-05-09T12:41:45Z")
You mean, as opposed to it being in filebeat.yml?
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [May 9, 2022, 12:57pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/12 "2022-05-09T12:57:26Z")
correct
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 6, 2022, 2:58pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850/13 "2022-06-06T14:58:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.