# Multiple filebeat\_\.yml files from a central log sever **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 7, 2018, 2:08pm UTC](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894 "2018-03-07T14:08:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![penguingeek](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@penguingeek](https://discuss.elastic.co/u/penguingeek)\ **Post date:** [March 7, 2018, 2:08pm UTC](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894/1 "2018-03-07T14:08:50Z")
I have a central log server that i want to forward logs to logstash from. The issue I am having is that since I am forwarding logs to the central server, there are no logs stored locally for filebeat to pull from. Now i am trying to separate those logs from the central server to ship to logstash, to then be forwarded on to elasticsearch (into host-based indexes). I was using "filebeat.config.prospector" but from what I can tell from the documentation, I can only have separate prospectors, not multiple full conf.d/.yml files. I am using: 64bit CentOS 7 Filebeat 6.2.2 filebeat.yml: filebeat.config.prospectors: enabled: true path: /etc/filebeat/conf.d/\*.yml conf.d/.yml: filebeat.prospectors: - type: log enabled: true paths: - /var/log//\*.log exclude\_files: [".gz$"] name: tags: [""] logstash.registry\_file: /var/lib/filebeat/registry setup.dashboards.enabled: false setup.kibana: host: ":5601" output.logstash: hosts: [":10514"] logging.level: info ---
**Author:** ![penguingeek](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@penguingeek](https://discuss.elastic.co/u/penguingeek)\ **Post date:** [March 8, 2018, 3:14pm UTC](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894/2 "2018-03-08T15:14:36Z")
I managed to work around this issue by changing the "name:" value into a tag and moving the tags under "logstash.prospecters:" in all the .yml files under conf.d/ This isn't ideal, as I was hoping to do some preprocessing before logstash, but this at least lets me move forward. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 12, 2018, 8:29am UTC](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894/3 "2018-03-12T08:29:50Z")
I'm glad you found a solution. What is the "preprocessing" step you can't do? ---
**Author:** ![penguingeek](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@penguingeek](https://discuss.elastic.co/u/penguingeek)\ **Post date:** [March 12, 2018, 7:13pm UTC](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894/4 "2018-03-12T19:13:34Z")
Hey ruflin, Basically logs from a particular set of hosts are being forwarded to a central server and no logs are being kept local. So I am trying to run filebeat from the central log server and maintain the "from\_host" as the original sending host, not the central server. I was hoping i could do this with individual yml files, but after looking through all the documentation, it seems like I can only do this with tags under the prospector section. That's a lot of config management to have separate config files just for hostname tags. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 14, 2018, 8:36am UTC](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894/5 "2018-03-14T08:36:13Z")
As you probably know filebeat is expected to run on the edge. You state above that there are no logs on the edge machine because they are forwarded to a central server. So at some point the logs seem to be there, why not directly use filebeat on the edge servers. This would simplify your setup I would hope. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 11, 2018, 8:36am UTC](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894/6 "2018-04-11T08:36:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.