# Can't filebeat use multiple input/output config files in one instance?

**URL:** <https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 18, 2020, 11:59am UTC](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095 "2020-12-18T11:59:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![iooi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iooi/32/79231_2.png) [@iooi](https://discuss.elastic.co/u/iooi)\
**Post date:** [December 18, 2020, 11:59am UTC](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095/1 "2020-12-18T11:59:53Z")

</div>

Want to deploy filebeat with 3 log definations together. Send to different output targets.

```auto
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  labels:
    k8s-app: filebeat
spec:
  selector:
    matchLabels:
      k8s-app: filebeat
  template:
    metadata:
      labels:
        k8s-app: filebeat
    spec:
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
        - name: filebeat
          image: docker.elastic.co/beats/filebeat:7.10.0
          args: [
            "-c", "/etc/logs1.yml",
            "-c", "/etc/logs2.yml",
            "-c", "/etc/logs3.yml",
            "-e",
          ]
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          securityContext:
            runAsUser: 0
          resources:
            limits:
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          volumeMounts:
            - name: config-logs1
              mountPath: /etc/logs1.yml
              subPath: filebeat-logs1.yml
              readOnly: true
            - name: config-logs2
              mountPath: /etc/logs2.yml
              subPath: logs2.yml
              readOnly: true
            - name: config-logs3
              mountPath: /etc/logs3.yml
              subPath: logs3.yml
              readOnly: true
            - name: data
              mountPath: /usr/share/filebeat/data
            - name: varlibdockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
            - name: varlog
              mountPath: /var/log
              readOnly: true
      volumes:
        - name: config-logs1
          configMap:
            defaultMode: 0600
            name: configmap-logs1
        - name: config-logs2
          configMap:
            defaultMode: 0600
            name: configmap-logs2
        - name: config-logs3
          configMap:
            defaultMode: 0600
            name: configmap-logs3
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers
        - name: varlog
          hostPath:
            path: /var/log
        - name: data
          hostPath:
            path: /var/lib/filebeat-data
            type: DirectoryOrCreate

```

logs1's configmap

```auto
data:
  filebeat-logs1.yml: |-
    filebeat.inputs:
      - type: log
        enabled: true
        paths:
          - /var/log/logs1.json

    output.logstash:
      hosts: ["logstash-logs1.default.svc.cluster.local:5044"]

```

logs2's configmap

```auto
data:
  filebeat-logs2.yml: |-
    filebeat.inputs:
      - type: log
        enabled: true
        paths:
          - /var/log/logs2.json

    output.logstash:
      hosts: ["logstash-logs2.default.svc.cluster.local:5044"]

```

logs3's configmap

```auto
data:
  filebeat-logs3.yml: |-
    filebeat.inputs:
      - type: log
        enabled: true
        paths:
          - /var/log/logs3.json

    output.logstash:
      hosts: ["logstash-logs3.default.svc.cluster.local:5044"]

```

When each log files changed, every time it only send to the third logs3's output `logstash-logs3.default.svc.cluster.local:5044`. But can get data all of three logs1.json/logs2.json/logs3.json files.

Can't filebeat use multiple output in this case on one machine?

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [December 18, 2020, 1:08pm UTC](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095/2 "2020-12-18T13:08:31Z")

</div>

Do any of filebeats report any error in logs? Did you try to use config prospectors? See: [Multiple configuration file with enabled option](https://discuss.elastic.co/t/multiple-configuration-file-with-enabled-option/155899)

---

<div class="post-metadata">

**Author:** ![iooi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iooi/32/79231_2.png) [@iooi](https://discuss.elastic.co/u/iooi)\
**Post date:** [December 18, 2020, 1:33pm UTC](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095/3 "2020-12-18T13:33:30Z")

</div>

I didn't find errors. Only work for the third output. I can use **prospectores**. This method seems can work: [How to tag log files in filebeat for logstash ingestion?](https://discuss.elastic.co/t/how-to-tag-log-files-in-filebeat-for-logstash-ingestion/44713/7)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2021, 3:33pm UTC](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095/4 "2021-01-15T15:33:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.