# Many Apache servers on one machine? **URL:** \ **Category:** Beats\ **Tags:** beats-module, filebeat\ **Created:** [June 19, 2019, 6:45am UTC](https://discuss.elastic.co/t/many-apache-servers-on-one-machine/186386 "2019-06-19T06:45:39Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![baerrach](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baerrach/32/48119_2.png) [@baerrach](https://discuss.elastic.co/u/baerrach)\ **Post date:** [June 19, 2019, 6:45am UTC](https://discuss.elastic.co/t/many-apache-servers-on-one-machine/186386/1 "2019-06-19T06:45:39Z")
I've got a machine with many Apache servers on it. The Apache logs got into different directories, - /srv/host1.com/logs - /srv/host2.com/logs - etc If I enable modules this will use the default paths, which obviously wont find these files. I can update the var.paths for both access and errors to include each hosts' log files. But I was contemplating adding tags, like host1, so these files are grouped together. The [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-modules.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-modules.html) documentation says using modules is optional and that I can configure these manually. Yet there is no documentation that tells me what the modules do so that I can apply this manually. I can look into the source of the Apache module at [https://github.com/elastic/beats/tree/master/filebeat/module/apache](https://github.com/elastic/beats/tree/master/filebeat/module/apache) but I can't work out how to re-use `ingest/default.json` from a manual configuration. [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#\_literal\_pipeline\_literal](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#_literal_pipeline_literal) says I need the `pipeline ID` but there are no pipelines defined in my Kibana console. Perhaps because I haven't yet enable Apache logging... What is the correct way to setup filebeats to monitor multiple Apache servers? ---
**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\ **Post date:** [June 19, 2019, 12:07pm UTC](https://discuss.elastic.co/t/many-apache-servers-on-one-machine/186386/2 "2019-06-19T12:07:07Z")
Hi @baerrach 🙂 Your use case is a bit special and the easiest setup is to run a single Filebeat with each Apache instance (activating Apache module) and adding your own fields on each config file. [https://www.elastic.co/guide/en/beats/filebeat/master/add-fields.html](https://www.elastic.co/guide/en/beats/filebeat/master/add-fields.html) A second option could be to use `add_process_metadata` but I have to admit that I'm not fully sure if it will solve your issue. I haven't tried to use it that way. A third option could be to use an Ingest node of Elasticsearch with a Pipeline [https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html) defined to manipulate the incoming string of log data and infer the process that it comes from. You don't need a dedicated ingest node althought it's recommended. ---
**Author:** ![baerrach](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baerrach/32/48119_2.png) [@baerrach](https://discuss.elastic.co/u/baerrach)\ **Post date:** [June 19, 2019, 11:38pm UTC](https://discuss.elastic.co/t/many-apache-servers-on-one-machine/186386/3 "2019-06-19T23:38:07Z")
@Mario_Castro Thanks for the reply. I'm into day 10 of Elastic Stack understanding. I've ready all the docs, but I don't understand what you mean. Are you suggesting I run one instance of Filebeat with all the configurations in it, or one Filebeat per Apache instance each with their own configuration files? If I have multiple Filebeats then I wont be able to use simple commands like `sudo service filebeat start`, I'll need to create a service for each customization... or is there another way? Can you show me what an example setup might look like? Cheers ---
**Author:** ![sjabiulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sjabiulla/32/48429_2.png) [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\ **Post date:** [June 20, 2019, 7:02am UTC](https://discuss.elastic.co/t/many-apache-servers-on-one-machine/186386/4 "2019-06-20T07:02:15Z")
From my understanding you can achieve your use case with below steps 1. Enable apache module on filebeats. `filebeat modules enable apache2` 2. Write the filebeat config to index the data to ElasticSearch. filebeat\_apache\_config.yml 3. Now, you can start the filebeats using the below cmd `filebeat -e -M "apache2.access.var.paths=[/srv/host1.com/logs]" -M -c filebeat_apache_config.yml` 1. Now, you can start again a new instance of filebeats by changing the path of log file `filebeat -e -M "apache2.access.var.paths=[/srv/host2.com/logs]" -M -c filebeat_apache_config.yml` 1. If you want to index the data from each log file to different indexes, then you can create different yml config files and use the different files while starting filebeats. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 18, 2019, 7:02am UTC](https://discuss.elastic.co/t/many-apache-servers-on-one-machine/186386/5 "2019-07-18T07:02:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.