# Can filebeat send to different LS servers based on hostname criteria

**URL:** <https://discuss.elastic.co/t/can-filebeat-send-to-different-ls-servers-based-on-hostname-criteria/157028>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 16, 2018, 10:53am UTC](https://discuss.elastic.co/t/can-filebeat-send-to-different-ls-servers-based-on-hostname-criteria/157028 "2018-11-16T10:53:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![minz](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@minz](https://discuss.elastic.co/u/minz)\
**Post date:** [November 16, 2018, 10:53am UTC](https://discuss.elastic.co/t/can-filebeat-send-to-different-ls-servers-based-on-hostname-criteria/157028/1 "2018-11-16T10:53:42Z")

</div>

Hello,

I'm wondering if filebeat can be configured with many output.logstash hosts but would send the data only to one LS acording to a condition.

For instance, I have 4 machines (F1,F2,F3,F4) owning the same configuration of filebeat and 2 LS servers (L1, L2). I would like to send files from F1,F2,F3 to L1 and from F4 to L2 :

```
output.logstash:
  # Boolean flag to enable or disable the output module.
  enabled: true

  # The Logstash hosts
  hosts: ["L1"]
  when:
    or
	  - equals:
        beat.hostname: "F1"
	  - equals:
        beat.hostname: "F2"
	  - equals:
        beat.hostname: "F3"		

  hosts: ["L2"]
  when:
    equals:
      beat.hostname: "F4"

```

Else I need to own differents configurations on each F machine ☹

Is it possible ?

PS : limitation might be the same as [Can filebeat be configured to send to different ES or logstash servers?](https://discuss.elastic.co/t/can-filebeat-be-configured-to-send-to-different-es-or-logstash-servers/41503/1)

Best regards

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 16, 2018, 1:57pm UTC](https://discuss.elastic.co/t/can-filebeat-send-to-different-ls-servers-based-on-hostname-criteria/157028/2 "2018-11-16T13:57:18Z")

</div>

> PS : limitation might be the same as [Can filebeat be configured to send to different ES or logstash servers?](https://discuss.elastic.co/t/can-filebeat-be-configured-to-send-to-different-es-or-logstash-servers/41503/1)

Right. Filebeat does not support event routing.

You could provide the filebeat configuration as a template and have your provisioning system (or some custom startup script) create the final per machine configuration from your template.

One can also use variables like this:

```auto
output.logstash:
  hosts: ["${LOGSTASH_HOST}"]

```

Variables can be either set via:

- environment variables
- another configuration file and start filebeat with multiple config files: (e.g. `filebeat -c main.yml -c vars.yml` )
- add variable to startup command: (e.g. `filebeat -E LOGSTASH_HOST=...`)
- having provisioning, just append variables to end of the config file like (`echo LOGSTASH_HOST: ...` \>\> /etc/filebeat/filebeat.yml)

---

<div class="post-metadata">

**Author:** ![minz](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@minz](https://discuss.elastic.co/u/minz)\
**Post date:** [November 16, 2018, 2:31pm UTC](https://discuss.elastic.co/t/can-filebeat-send-to-different-ls-servers-based-on-hostname-criteria/157028/3 "2018-11-16T14:31:54Z")

</div>

Thank you for your reply Steffen .

If it can help somebody, best solution I found is :

- create a new yml file named _/appli/projects/filebeat-6.0.1-linux-x86\_64/envs/filebeat\_MYHOSTNAME.yml_ owning the configuration with LOGSTASH\_HOST=...
- change /etc/systemd/system/filebeat.service by adding _-c /appli/projects/filebeat-6.0.1-linux-x86\_64/envs/filebeat_%H.yml
- modify my filebeat.yml to use the variable : _hosts: ["${LOGSTASH\_HOST}"]_

So, I'm now able to separate common configuration and server configuration 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2018, 2:31pm UTC](https://discuss.elastic.co/t/can-filebeat-send-to-different-ls-servers-based-on-hostname-criteria/157028/4 "2018-12-14T14:31:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.