How to setup two different output (index, pipeline) with Filebeat

I'm trying to setup with one filebeat instance the apache module and the Tomcat module because we have done customisation in the pipeline and would like to have two separate indices I try the following
configuration:

output.elasticsearch:
    hosts: ["node1:9200" , "node2:9200" , "node3:9200"]
    api_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    protocol: "https"
    indices:
        - index: "httpd_dev-%{+yyyy.MM}"
          when.equals:
            event.category: "web"
        - index: "tomcat_dev-%{+yyyy.MM}"
          when.equals:
            event.category: "tomcat"
    pipelines:
        - pipeline: "filebeat-7.13.2-apache-*"
          when.equals:
            event.category: "httpd"
        - pipeline: "filebeat-7.13.2-tomcat-*"
          when.equals:
            event.category: "tomcat"


But the result seem to be that all the event are sent to the tomcat pipeline and the tomcat index , when I setup the apache module alone the module worked fine.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.