Multiple filebeat instances on RedHat using "service"

Elastic Stack Beats
1

Hello,

I am a redhat user using Filebeat 6.2.2 installed through rpm.

I need to send some log files to multiple logstash instances and the only solution in my situation is running two filebeat instances in parallel.

I've found some topics talking about systemctl or filebeat-god methods, but no one seems to be adapted to my Redhat environment.

I'm actually running filebeat as a service through the command "service filebeat start"
How can I run another instance of a filebeat service in parallel ?

Thanks

2

@xavier I think there are two solutions you could do here.

  1. Duplicates the existing startup scripts with a different name to run a second filebeat instance.

  2. Or run 1 filebeat and send all events to a single Logstash and use conditionals to do the appropriate work.

Why do you need to send your data to 2 different logstash?

3

Hello,

Thanks for the answer.

1 - I tried to launch a second instance with new conf and registry files through filebeat-god, with no success.

2 - Impossible, because I don't want to "separate" data, I want to duplicate them

The reason for this need is that we have two internal projects which need to receive each a copy of log lines.
The two projects can't exchange data directly and we have to send them through Filebeat to two Logstash in parallel.

I found a temporary solution,

I installed a .tar.gz version of filebeat in another path, and I've duplicated the configuration from the first filebeat.
Then I start this standalone filebeat instance with a "nohup" command to detach it from the shell and my SSH session.

Regards,

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.