Logstash parsing data from multiple filebeats

[Vladpov]

Hey guys!

I'm wondering if there is any solution for following scenario:

I have one machine on which I have set Elasticsearch and Logstash and shipping there logs via Filebeat from another machine. I'd like to add a new machine from which I could ship logs to Logstash, parse them and store in the same elasticsearch index.

I tried to configurate filebeat on new machine with the same Logstash output but it seems logstash doesn't recieve data from multiple sources...

Thanks for any suggestions!

[A_B]

Hi @Vladpov,

I have hundreds of machines sharing a coupe of Logstash instances. So it is definitely technically possible to have several machines using the same Logstash.

Do you see any error messages in the logs of Logstash? Logstash logs are usually quite revealing.

Could you share your Filebeat output and Logstash input configs?

Have you ensured the new machine can connect to Logstash i.e. no firewalls or other network limitation is in the way....