Multi output for multi prospectors

Elastic Stack Beats
1

I use ELK 5.0.1 + Filebeat 5.0.1.

On my server I have 2 kind of prospectors :

  • json logs
  • text logs

Currently, I configure Filebeat to send the json logs directly to elasticsearch.
This works fine.

Now I want to send the text logs to logstash to parse them with a grok filter.

In the Filebeat configuration, I don't find how to use 2 output for this 2 prospectors.

Is it possible ?
How can I do this ?

1 Like
2

It is not possible to route the events to different outputs. All events go to all outputs. So you can send it all to Logstash and then route the events from there.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.