Filebeat push same event in multiple indices

Hello, is it possible to send the same event into multiple indices in the same elasticsearch cluster?
Example filebeat.yml:

	  enabled: true
	  path: ${path.config}/inputs/*.yml
		enabled: true
		period: 10s
	  - decode_json_fields:
		  fields: [""]
		hosts: ["https://xxx:9200"]
		  - index: "filebeat-7.12.0-app1"
			  component: "app1"
		  - index: "filebeat-usa"
			when.equals: "usa"

and this is the filebeat input:

	- type: log
		- /var/log/apps/aaa.json
		component: app1
		team: xxx
	  fields_under_root: true
	  scan_frequency: 10s
	  json.keys_under_root: true
	  json.add_error_key: true

test command:

    echo '{"outer":"value","":"usa","inner":"{\"data\":\"value\"}"}' >> /var/log/apps/aaa.json

Expected result is to have the same event in both indices: filebeat-7.12.0-app1 (first match - because of component field) and filebeat-usa (second match - because of processors and the decode of the specific field

Actual result is: the event goes into the first match (which is correct based on the docs), but is it possible to send the same event into multiple indices without logstash?

I know it's possible with logstash but I don't want to introduce another component into the infrastructure.

I don't think it is when sending directly from filebeat. I think ur best way is to send from logstash as that can multiple outputs in parallel.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.