# Beats (6.8.2) via Logstash using collectd index when more than one host specified

**URL:** <https://discuss.elastic.co/t/beats-6-8-2-via-logstash-using-collectd-index-when-more-than-one-host-specified/194510>\
**Category:** Beats\
**Created:** [August 8, 2019, 10:48pm UTC](https://discuss.elastic.co/t/beats-6-8-2-via-logstash-using-collectd-index-when-more-than-one-host-specified/194510 "2019-08-08T22:48:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TomD](https://avatars.discourse-cdn.com/v4/letter/t/b4bc9f/32.png) [@TomD](https://discuss.elastic.co/u/TomD)\
**Post date:** [August 8, 2019, 10:48pm UTC](https://discuss.elastic.co/t/beats-6-8-2-via-logstash-using-collectd-index-when-more-than-one-host-specified/194510/1 "2019-08-08T22:48:46Z")

</div>

Hi

If I modify the default config (/etc/filebeat/filebeat.yml) to disable output.elasticsearch and add output.logstash like below I get duplicate updates. One to filebeat-6.8.2-2019.08.08 and another to collectd-2019.08.08

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/messages
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
output.logstash:
  hosts: ['logstash01', 'logstash02']
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

```

I use default Logstash configs on both logstash hosts with this /etc/logstash/conf.d/beats.conf as per the documentation

```
input {
  beats {
    port => 5044
  }
}
output {
  elasticsearch {
    hosts => ["elastic01", "elastic02", "elastic03"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
}

```

Using one logstash host results in the expected behaviour of updates only to the filebeat-\* index. I have tried loadbalance: true but it makes no difference

Is this a known issue or am I doing something wrong?

Thanks

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 9, 2019, 3:03pm UTC](https://discuss.elastic.co/t/beats-6-8-2-via-logstash-using-collectd-index-when-more-than-one-host-specified/194510/2 "2019-08-09T15:03:59Z")

</div>

Where did you configure the index `collectd-2019.08.08`?

---

<div class="post-metadata">

**Author:** ![TomD](https://avatars.discourse-cdn.com/v4/letter/t/b4bc9f/32.png) [@TomD](https://discuss.elastic.co/u/TomD)\
**Post date:** [August 9, 2019, 3:26pm UTC](https://discuss.elastic.co/t/beats-6-8-2-via-logstash-using-collectd-index-when-more-than-one-host-specified/194510/3 "2019-08-09T15:26:06Z")

</div>

Hi  
I didn't. I don't have collectd publishing anywhere. I delete the index and filebeat/logstash create it again  
Thanks  
Tom

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2019, 5:26pm UTC](https://discuss.elastic.co/t/beats-6-8-2-via-logstash-using-collectd-index-when-more-than-one-host-specified/194510/4 "2019-09-06T17:26:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.