PS : limitation might be the same as Can filebeat be configured to send to different ES or logstash servers?
Right. Filebeat does not support event routing.
You could provide the filebeat configuration as a template and have your provisioning system (or some custom startup script) create the final per machine configuration from your template.
One can also use variables like this:
output.logstash:
hosts: ["${LOGSTASH_HOST}"]
Variables can be either set via:
- environment variables
- another configuration file and start filebeat with multiple config files: (e.g.
filebeat -c main.yml -c vars.yml) - add variable to startup command: (e.g.
filebeat -E LOGSTASH_HOST=...) - having provisioning, just append variables to end of the config file like (
echo LOGSTASH_HOST: ...>> /etc/filebeat/filebeat.yml)