# Can we configure Winlogbeat to send logs to multiple Logstash instances?

**URL:** <https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 26, 2018, 7:39pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840 "2018-07-26T19:39:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [July 26, 2018, 7:39pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840/1 "2018-07-26T19:39:52Z")

</div>

Hi,

I just to wanted to check if we can configure Winlogbeat to send logs to multiple Logstash instances? I have two different Logstash instances which would then send logs to two different Elasticsearch clusters. So, I would need to send logs to two different Logstash instances. Do I need to use multiple winlogbet config files?

Please help me solve the issue.

Thanks

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [July 26, 2018, 8:24pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840/2 "2018-07-26T20:24:17Z")

</div>

Hello @amruth,

Currently, Winlogbeat or any other beat doesn't support multiple output. You already have the Logstash infrastructure, you could use conditionals based on the data in the event to send it to the appropriate Elasticsearch cluster.

```auto
output {
   if [field] == "s1" {
      elasticsearch { ... } #cluster 1
   } else {
      elasticsearch{ ... } #cluster 2
   }
}
```

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [July 26, 2018, 8:26pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840/3 "2018-07-26T20:26:55Z")

</div>

Hi Pier,

But Logstash-1 can't talk to Elasticsearch-2. They are independent clusters. What should I do now? Can't I use 2 different winlogbeat yml files ?

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [July 26, 2018, 8:35pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840/5 "2018-07-26T20:35:38Z")

</div>

@amruth So your server has access to both of the cluster?

In that case, you could run two winlogbeat using different configuration and different [path.data](https://www.elastic.co/guide/en/beats/winlogbeat/6.3/configuration-path.html#_literal_data_literal)

This will use a bit more resource on the edge server.

It is for replication; both clusters have all the events?

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [July 26, 2018, 8:42pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840/6 "2018-07-26T20:42:12Z")

</div>

I will try to explain it clearly..

So, Winlogbeat(on App server) needs to send logs to Logstash-1(which would then send logs to Elasticsearch-1 cluster) and also to Logstash-2(which would then send logs to Elasticsearch-2 cluster). Basically, all the logs on App server need to be sent to Elasticsearch-1 and Elasticsearch-2 clusters. And, these two clusters are independent which means even Logstash-1 can't reach Elasticsearch-2.

So, do I need to run two different Winlogbeats on App server?

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [July 26, 2018, 8:46pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840/7 "2018-07-26T20:46:45Z")

</div>

@amruth Yes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2018, 8:46pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840/8 "2018-08-23T20:46:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.