I'm wondering if filebeat can be configured with many output.logstash hosts but would send the data only to one LS acording to a condition.
For instance, I have 4 machines (F1,F2,F3,F4) owning the same configuration of filebeat and 2 LS servers (L1, L2). I would like to send files from F1,F2,F3 to L1 and from F4 to L2 :
output.logstash: # Boolean flag to enable or disable the output module. enabled: true # The Logstash hosts hosts: ["L1"] when: or - equals: beat.hostname: "F1" - equals: beat.hostname: "F2" - equals: beat.hostname: "F3" hosts: ["L2"] when: equals: beat.hostname: "F4"
Else I need to own differents configurations on each F machine
Is it possible ?
PS : limitation might be the same as Can filebeat be configured to send to different ES or logstash servers?