Filebeat output all events to multiple logstash instances

Elastic Stack Beats
1

Hi There,

I'm trying to send all log events ("tee") to two separate logstash instances using filebeat. This is not to accomplish HA, but rather to send all log events to my logstash cluster and my customer's logstash cluster.

Can this be accomplished with the current version of filebeat?

Thanks!

2

No, it's better to use something like Kafka with consumer groups and have the two Logstash clusters consume data from Kafka. If two disparate Logstash outputs were configured then if "your" cluster was down the customer cluster would also stop receiving events because the output would be blocked.

See: https://github.com/elastic/beats/issues/1035#issuecomment-189205217