Conditional filebeat output to logstash

Hi All,

We have done setup of ELK with 5.6.3 and filebeat-5.6.3 also installed on hosts to push logs. It is running fine. We need segregation for prod/dev indexes for which we have done another setup for my 'dev' environment logs and filebeat remained same on app hosts.

After went through several documentation I couldn't find the way. Our requirement is split the output to logstash i.e document_type 'prod' should go to production logstash/elasticsearch, while document_type 'dev' should go to dev logstash/elasticsearch.

Please suggest on this.

Filebeat does not support multiple outputs, so to not accidentally couple production and dev environments. Normally users configure 2 filebeat instances in this case. One for production and another one for dev.

Hi,

Thank you. We configured another filebeat yml file. Now, it is working as expected.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.