Multi output for multi prospectors


I use ELK 5.0.1 + Filebeat 5.0.1.

On my server I have 2 kind of prospectors :

  • json logs
  • text logs

Currently, I configure Filebeat to send the json logs directly to elasticsearch.
This works fine.

Now I want to send the text logs to logstash to parse them with a grok filter.

In the Filebeat configuration, I don't find how to use 2 output for this 2 prospectors.

Is it possible ?
How can I do this ?

(Andrew Kroh) #2

It is not possible to route the events to different outputs. All events go to all outputs. So you can send it all to Logstash and then route the events from there.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.