How to make beats send data to multiple instances

[Santhosh_Kumar247 (Santhosh Kumar)]

Hello,

I have the following setting in the filebeats.yml:
Two conditions input for logs

filebeat.inputs:
- paths:
    - E: \ log_type1 _ *. Log
  fields_under_root: true
  fields:
    type: type1

- paths:
    - E: \ log_type2 _ *. Log
  fields_under_root: true
  fields:
    type: type2

And in my logstash I have two pipelines “pipeline_type1.conf” in port 9601 and “pipeline_type2.conf” in port 9602.

I'd like to know if it's possible set in filebeats.yml two outputs like

If (type = ‘type1’)
output.logstash:
  hosts: ["localhost: 9601"]
If (type = ‘type2’)
output.logstash:
  hosts: ["localost: 9602"]

Or send all data for both ports, and in the pipeline's filter include an if for each type.

If there is no solution like those, I thought in include one more filebeat agent and each one has its output.

[jsoriano (Jaime Soriano)]

Hey @Santhosh_Kumar247, welcome to discuss

It is not possible to use multiple outputs with the same beat. The only option would be what you said to use multiple filebeats, with the same configuration, but each one with its own output.

In your case you also have different inputs, so I would suggest to configure multiple Filebeat instances, each one to collect and send each type of logs.