# How to configure filbeat to forward data/syslogs to logstash on 2 different ports

**URL:** <https://discuss.elastic.co/t/how-to-configure-filbeat-to-forward-data-syslogs-to-logstash-on-2-different-ports/364506>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 7, 2024, 2:52am UTC](https://discuss.elastic.co/t/how-to-configure-filbeat-to-forward-data-syslogs-to-logstash-on-2-different-ports/364506 "2024-08-07T02:52:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hydroponics](https://avatars.discourse-cdn.com/v4/letter/h/e5b9ba/32.png) [@hydroponics](https://discuss.elastic.co/u/hydroponics)\
**Post date:** [August 7, 2024, 2:52am UTC](https://discuss.elastic.co/t/how-to-configure-filbeat-to-forward-data-syslogs-to-logstash-on-2-different-ports/364506/1 "2024-08-07T02:52:43Z")

</div>

I've a device syslogs where its being sent to filebeat on 2different ports, as its planned to forward from logstash to 2 different places like DataCenter-1 Elastic search and other place like external server as syslog itself. Whats the best approach and practice we can follow here? Please provide sample config, Your suggestions are highly appreciated.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 7, 2024, 3:25am UTC](https://discuss.elastic.co/t/how-to-configure-filbeat-to-forward-data-syslogs-to-logstash-on-2-different-ports/364506/2 "2024-08-07T03:25:22Z")

</div>

Hello and welcome,

This is not possible, Filebeat can have only **one** output.

What you can do is send your filebeat logs to **one** Logstash and then use this Logstash to forward it to different outputs.

---

<div class="post-metadata">

**Author:** ![hydroponics](https://avatars.discourse-cdn.com/v4/letter/h/e5b9ba/32.png) [@hydroponics](https://discuss.elastic.co/u/hydroponics)\
**Post date:** [August 7, 2024, 6:26pm UTC](https://discuss.elastic.co/t/how-to-configure-filbeat-to-forward-data-syslogs-to-logstash-on-2-different-ports/364506/3 "2024-08-07T18:26:48Z")

</div>

Thanks @leandrojmp

---

<div class="post-metadata">

**Author:** ![OneWhoKnowsNothing](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@OneWhoKnowsNothing](https://discuss.elastic.co/u/OneWhoKnowsNothing)\
**Post date:** [August 9, 2024, 6:16pm UTC](https://discuss.elastic.co/t/how-to-configure-filbeat-to-forward-data-syslogs-to-logstash-on-2-different-ports/364506/4 "2024-08-09T18:16:16Z")

</div>

You can also run multiple instances of filebeat, one sending the logs to one location and another to a different location.  
I have one server sending stuff to elastic and another to logstash that feeds it opensearch.