Exiting: error unpacking config data: more than one namespace configured accessing 'output' (source:'filebeat.yml')

[Bhavin_Varsur]

when i enable elasticsearch output and logstash output in filebeat.yml i get this error.
Exiting: error unpacking config data: more than one namespace configured accessing 'output' (source:'filebeat.yml')

please give me the solution of this problem !!

here are my filebeat.yml file:

filebeat.inputs:

• type: log
  enabled: true
  paths:
  • /var/log/*.log
  • D:\Git\finance.api\FinanceAPI\logs*.log
    #- c:\programdata\elasticsearch\logs*

filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false

setup.template.settings:
index.number_of_shards: 1

setup.kibana:

host: "localhost:5601"

output.elasticsearch:
hosts: ["localhost:9200"]
username: "elastic"
password: "changeme"

output.logstash:
hosts: ["localhost:5044"]

[grumo35]

You cannot have 2 different output on the same filebeat.

Please consider using logstash as a forwarder or another filebeat.

[Bhavin_Varsur]

Thank you for your reply !!
now I have only one output is a logstash output.
can you tell me how can I do logstash as forwarder or another instance of filebeat ?

[grumo35]

Hi, can you mark the topic as solved to improve research for the community ?

Can't you just use logstash as an output to elasticsearch ?
Do you need to run 2 separates pipelines ?

[Bhavin_Varsur]

yeah sure !!

tell me how can I run 2 separate pipeline how can do that , I'm new to this technology so I can't figure out that solution .

here are my first-pipeline.config file.

Beats -> Logstash -> Elasticsearch pipeline.

input {
beats {
port => 5044
}
}
filter{
grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
user => "test"
password => "test123"
}
}

[grumo35]

I dont understand why do you need filebeat to forward to both logstash and elasticsearch, while you already push logs to elasticsearch using logstash ?

I'm actually trying to understand if you need to send the same log 2 times in elastic ?

data --> filebeat --> logstash --> elastic

[Bhavin_Varsur]

I've multiple .net core projects which have logs so i want to show those logs into kibana dashboard in elasticsearch.
so that i use filebeat to send those logs to logstash.then logstash send those logs to elastic

log files => filebeat => logstash => elasticsearch
this is what i want to do.

[grumo35]

Ok so you dont really need to have 2 separates pipelines, if you do need to separates projects you can always tag logs depending on their sources.

Tag example :

# Foo o365
- type: log
  enabled: true
  paths:
    - "/var/log/o365.log"
  encoding: utf-8
  tags: ["foo365"]