Beats output to two ES clusters

Elastic Stack Beats
1

I have seen posts about Logstash output to multiple ES clusters. But how about Beats? Rather, can I do this?

metricbeat.yml

output.elasticsearch:
hosts: ["cluster1-node1", "cluster1-node2", "cluster1-node3", "cluster2-node1", "cluster2-node2", "cluster2-node3"]

It appears to work fine on Linux, but am getting mixed results on Windows.

Am looking for tips/caveats.

2

Hi,

Using multiple hosts is probably not doing what you expect. One event is only sent to one of the hosts (unless there is a failure). Beats can't duplicate events to different clusters. If that's what you want, you need to use Logstash.

3

Thanks @adrisr! Will switch to using Logstash. I have another question, but will check existing threads first and post another question if needed.