Different output for different hosts

[f3rdy]

Hi,

I'm not sure, if beats is the right place to put my question here, maybe it's also logstash or elasticsearch or kibana...

For explanation: I run top beat on two different hosts and an ELK stack on another host. I use the topbeat-dashboard from the examples and run on a search for topbeat-*. Since the two hosts (say jcl02, jcl03) topbeat to elastic directly (didn't get filters and stuff to work with logstash yet) , they will be shown on the dashboard together. Worse than that, cpu load averages are calculated together, while I just want to have the results of the single hosts.

My question: Is it somehow possible to have a dashboard for each of the jcl* hosts, so I can gather average values from each host separately?

Thanks,
Fred

[steffens (Steffen Siering)]

Options might be using a search or some kibana field filter. kibana dashboards can be bookmarked. The bookmark will contain the search filter and all settings.

[mourlos (Harry)]

Hi,

Since they are both going to elasticsearch, you can specify the index that they will be written to.
Have a look here : https://www.elastic.co/guide/en/beats/topbeat/current/elasticsearch-output.html
It is straight forward.

As you said, the other option would be to go through logstash where you can specify the output with many different ways.

Hope it helps.

[monica (Monica Sarbu)]

You can simply visualize the dashboard with data coming from a single host by using the search box from the dashboard. You can try using the filter: beat.name: jcl02 and the data in your dashboard will be updated with info coming from jcl02. You can save the dashboard view to something like Topbeat Dashbord - jcl02 by clicking on the Save button and pass a different name.