Can different metrics go to different output and have different schedules?

Elastic Stack Beats
1

I have some questions about what the MetricBeat can do in some situations. I wonder if anyone can help me.

  1. Can I configure more than one output (e.g. elastic search and logstash. This is purely hypothetical. Just examples to show what I mean.) in metricbeat.yml?

  2. If yes, will that means the same sets of data will be sent to two destinations? Basically two copies?

  3. I see that logstash output allows load balance which has to be explicitly enabled to achieve. If I don't enable it, will that means each logstash host will receive a copy of the data? For others (e.g. ElasticSearch), I guess I can also configure multiple hosts. But it does not have load balance. Will that means if I do configure multiple, each host will receive a copy?

  4. Is there any way to set up so that different metric set will go to different output?

  5. Right now it seems that (in the example metricbeat.full.yml file) at the end of system module we can set the period. This applies to all in the system module. Will it be possible to set up different periods for different metric set(s)?

I appreciate any lights on these.

Thanks,

Wayne

2

No. If you need to have more final destination then send to Logstash and route the data from there. If you provide more details on what you are trying to accomplish we can likely offer more tailored advice.

It will only send an event to one output destination. See Elasticsearch Output | Filebeat Reference [5.6] | Elastic. The events are distributed to these nodes in round robin order. If one node becomes unreachable, the event is automatically sent to another node.

No.

Yes. You can configure multiple instances of any modules. Each instance can have its own period. For example see this config file.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.