How to make beats send data to multiple instances

Elastic Stack Beats
1

Dear ElasticSearch Team,

Here I take logs use case as an example, Basically, we'll collect these system logs, application logs, business logs for each application on our production, and ship them to different logstash clusters instead of a logstash cluster.

which means we want filebeat send logs to different logstash cluster for each type of logs. but filebeat only can send data to a destination by default.

We don't want everything goes through a dedicate logstash cluster,
Is there a way can make a filebeat send data to multiple logstash clusters or how to run filebeat with multiple instances on a server in terms of different types of logs?

I'll appreciate that if Elastic Team can provide a solution with details.
It would be better if can provide of how to implement that step by step with instructions

I know Nxlog supports to send the data to multiple destinations, But I really want ship logs with filebeat.

Best Regards
Robin

2

One Filebeat instance is only able to send to one output. If you would like to forward events to multiple Logstashes, Elasticsearches, etc. you need to start multiple instances of Filebeat with different configuration.
Step by step getting started guide for Filebeat: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html

3

Hi @kvch

I meant that how to setup or enable multiple instances for a Filebeat app step by step.

not the URL you posted above to how to deploy filebeat.

Thanks

4

How can we run several filebeat instances on both windows and linux server?
Any updates?

5

You can start multiple instances with the same commands, so I am not sure what you expect.

You can configure the different folders of each filebeat by setting the options mentioned in:
https://www.elastic.co/guide/en/beats/filebeat/current/configuration-path.html

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.