# Different Logs to Different ELK Stacks

**URL:** <https://discuss.elastic.co/t/different-logs-to-different-elk-stacks/102289>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [September 29, 2017, 4:54pm UTC](https://discuss.elastic.co/t/different-logs-to-different-elk-stacks/102289 "2017-09-29T16:54:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tony\_Chirillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tony_chirillo/32/22647_2.png) [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Post date:** [September 29, 2017, 4:54pm UTC](https://discuss.elastic.co/t/different-logs-to-different-elk-stacks/102289/1 "2017-09-29T16:54:47Z")

</div>

Is it possible to configure an instance of Winlogbeat to send different logs to different elk stacks? If no, how would such be accomplished? Would that require the installation of multiple instances of Winlogbeat on servers?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 29, 2017, 5:00pm UTC](https://discuss.elastic.co/t/different-logs-to-different-elk-stacks/102289/2 "2017-09-29T17:00:55Z")

</div>

Beats cannot route events to different clusters. You can use Logstash to route events.

```auto
                +------> ES
 WLB +--> LS |
                +------> ES

```

In Logstash you can use a conditional statement to output to different elasticsearch instances.

```auto
output {
  if // some condition {
    elasticsearch {
      // ES cluster A
    }
  } else if // some other condition {
    elasticsearch {
      // ES cluster B
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2017, 8:36pm UTC](https://discuss.elastic.co/t/different-logs-to-different-elk-stacks/102289/3 "2017-09-29T20:36:53Z")

</div>

FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2017, 8:37pm UTC](https://discuss.elastic.co/t/different-logs-to-different-elk-stacks/102289/4 "2017-10-27T20:37:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.