How can i configure a new data path for another instance of filebeat?

Elastic Stack Beats
1

I used this doc to configure a new instance of filebeat: Configuring Multi-Instances of Beats on a Single Server.

But the new filebeat doesnt create files in new " Directories for Data and Logs". Journalctl shows " Exiting: /var/lib/filebeat/filebeat.lock: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data)"

what i need to do to filebeat send to the directory /var/lib/filebeat_02?

2

Problem with 3rd party articles the can leave out key steps...

You need to set all the correct project paths in the filebeat.yml or add them as command line parameters in your service file.

Curious why you want to run 2 instances

3

I have removed the Profiling tag from this post, as it is not about Elastic Universal Profiling.

4

All that was missing was the "path" within the service that points to the "log and lib" data files.

About your curiosity: the logs I receive are personalized. And using the ML tool it generates different multiline patterns. That's why it was necessary to have two filebeats on the same machine.

5

I am sure I don't understand because you certainly can do that with a single filebeat with multiple inputs / indices / pipelines ...

But glad it's working...

6

using multiple inputs / indices / pipelines doesn't work always for me. i don't now why.