# Filebeat log to multiple outputs like file and syslog
**URL:** https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743
**Category:** Beats
**Tags:** filebeat
**Created:** [June 12, 2023, 7:56am UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743 "2023-06-12T07:56:27Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@michaelbu](https://discuss.elastic.co/u/michaelbu)
#### Post date: [June 12, 2023, 7:56am UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/1 "2023-06-12T07:56:27Z")
Hi,
I'm using filebeat on Linux in this version:
```auto
$ rpm -qa | grep filebeat
filebeat-8.7.0-1.x86_64
```
I would like to log filebeat to logfiles and also to syslog. This is the configuration snippet:
```auto
logging:
to_files: true
to_syslog: true
files:
name: filebeat
rotateeverybytes: 10485760
keepfiles: 2
metrics:
enabled: false
path:
logs: /var/lib/graylog-sidecar/collectors/filebeat/log
...
```
Logging to syslog works fine ...
```auto
Jun 12 09:42:14 XXX filebeat[8839]: 2023-06-12T09:42:14.423+0200 INFO [publisher_pipeline_output] map[file.line:139 file.name:pipeline/client_worker.go] Connecting to backoff(async(tcp://loginput-t02.lvm.de:5046))#011{"ecs.version": "1.6.0"}
```
... but there are no logfiles:
```auto
$ ls -alh /var/lib/graylog-sidecar/collectors/filebeat/log
total 0
drwx------ 2 graylog graylog 6 Jun 12 09:41 .
drwxr-xr-x 4 graylog graylog 29 Jun 6 16:48 ..
```
Two questions:
1. Can only one log destination be used or should my configuration work?
2. Is it possible to change filebeats log format for syslog logging to json?
---
### Author:  [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [June 12, 2023, 10:08am UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/2 "2023-06-12T10:08:16Z")
Hi @michaelbu,
Multiple outputs for a single running instance of filebeat isn't supported. There is a discussion from 2021 [here](https://github.com/elastic/beats/issues/28925). There is a workaround posted [here](https://discuss.elastic.co/t/configure-file-beat-to-multiple-output/235471) where you can run 2 filebeats each pointing to a different output. Another alternative would be to use Logstash which [does support multiple outputs](https://www.elastic.co/blog/using-logstash-to-split-data-and-send-it-to-multiple-outputs).
For your second question, what do you mean by:
> [@michaelbu](#):
>
> change filebeats log format for syslog logging to json
Have you had a look at the [`syslog` processor](https://www.elastic.co/guide/en/beats/filebeat/current/syslog.html) to see if that does want you want to do?
---
### Author:  [@michaelbu](https://discuss.elastic.co/u/michaelbu)
#### Post date: [June 12, 2023, 11:55am UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/3 "2023-06-12T11:55:52Z")
Hi @carly.richmond,
thanks for your answer.
I think this is a misunderstanding: I do not want to send the logs to different output. I would like to configure the filebeat to log it's own messages both to files (the deafult) and to syslog.
Do you think this filebeat configuration snippet is valid?
```auto
...
logging:
to_files: true
to_syslog: true
...
```
I hope this clarifies my problem?
Regards
Michael
---
### Author:  [@michaelbu](https://discuss.elastic.co/u/michaelbu)
#### Post date: [June 16, 2023, 6:35am UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/4 "2023-06-16T06:35:18Z")
Hi,
is filebeat designed to send it's own logging only to one technology `to_files` or `to_syslog`?
Or is this a valid configuration?
```auto
logging.to_files: true
logging.to_syslog: true
```
---
### Author:  [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [June 16, 2023, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/5 "2023-06-16T13:16:49Z")
Hi @michaelbu,
I've been digging through the [beats repo](https://github.com/elastic/beats) as the docs suggest [it's one or the other to me](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html). I'm not sure logging to both is valid, but I'm double checking to see if I can get an answer for you.
---
### Author:  [@michaelbu](https://discuss.elastic.co/u/michaelbu)
#### Post date: [June 19, 2023, 8:22am UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/6 "2023-06-19T08:22:18Z")
Hi @carly.richmond,
> but I'm double checking to see if I can get an answer for you.
Thank you, that will be great!
---
### Author:  [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [June 19, 2023, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/7 "2023-06-19T14:45:51Z")
Hi @michaelbu,
Got an answer for you. For beats you can only specify one log output destination, not two. The relevant code is here:
>
Hope that helps!
---
### Author:  [@michaelbu](https://discuss.elastic.co/u/michaelbu)
#### Post date: [June 19, 2023, 2:53pm UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/8 "2023-06-19T14:53:04Z")
Hi @carly.richmond,
thank you for this clarifying this!
I think it'll confuses me a little bit. If only one destination is allowed, I'd expected a configuration like this:
```auto
logging.to: files
```
or alternativly
```auto
logging.to: syslog
```
Thank you very much!
Regards
Michael
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 17, 2023, 4:53pm UTC](https://discuss.elastic.co/t/filebeat-log-to-multiple-outputs-like-file-and-syslog/335743/9 "2023-07-17T16:53:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.