How to output Filebeat logs to multiple hosts without load balancing?

Elastic Stack Beats
1

Hello. I'm trying to send all the logs to multiple hosts, each host should receive all the logs being read by Filebeat. Is there a way to do this without having one Filebeat Service per host with a specific configuration. Please note that I don't want to load balance the logs. I'm trying to study the same logs on two different systems. Thanks for the help!

1 Like
2

Is the following what you are looking for? https://github.com/elastic/beats/issues/1035

3

Thanks, this looks like it is what I need.

I'm sending logs to a logstash server and to a graylog server.

Then in my filebeat.yml I can have something like this:

output:
    ### Logstash as output
    logstash:
        # The Logstash Development hosts
        hosts: ["logstash.dev.com:5044"]
        .
        .
        .
    logstash:
        # The Logstash Production hosts
        hosts: ["logstash.prod.com:5044"]
        .  
        .
        .

Does that looks good? @ruflin

4

The issue I sent was opened 7 days ago and is only in a discussion phase. There is nothing implemented or decided yet.

5

@ruflin thanks for the quick reply. I will then follow the conversations of the issue.

Thanks!!

6

Also check my reply why I think it's actually a bad idea to have filebeat output to dev and production logstash at the same time.

7

@steffens thanks I will look into it. I appreciate your time!