Beats output to two ES clusters

I have seen posts about Logstash output to multiple ES clusters. But how about Beats? Rather, can I do this?

metricbeat.yml

output.elasticsearch:
hosts: ["cluster1-node1", "cluster1-node2", "cluster1-node3", "cluster2-node1", "cluster2-node2", "cluster2-node3"]

It appears to work fine on Linux, but am getting mixed results on Windows.

Am looking for tips/caveats.

Hi,

Using multiple hosts is probably not doing what you expect. One event is only sent to one of the hosts (unless there is a failure). Beats can't duplicate events to different clusters. If that's what you want, you need to use Logstash.

Thanks @adrisr! Will switch to using Logstash. I have another question, but will check existing threads first and post another question if needed.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.