# Multiple filebeat to logstash

**URL:** <https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251>\
**Category:** Logstash\
**Created:** [October 17, 2017, 1:30pm UTC](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251 "2017-10-17T13:30:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![MLdz](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@MLdz](https://discuss.elastic.co/u/MLdz)\
**Post date:** [October 17, 2017, 1:30pm UTC](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251/1 "2017-10-17T13:30:36Z")

</div>

Hello,  
i want to connect two filebeat (which are on two differents remote machine) to Logstash.  
i did the configuration on the filebeat.yml with the host of the ELK server.  
The problem: in Kibana , i dont see the log of the 2 remote machine.  
I can see just the log of the 1st machine, or the log of the 2nd machine.  
What should I configure to see the logs of both machines at once?  
logstash.conf :

```
input { beats { port => 5044 } }
   output {
      elasticsearch {
        hosts => ["localhost:9200"]
           }
    }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 17, 2017, 2:25pm UTC](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251/2 "2017-10-17T14:25:03Z")

</div>

Check the Filebeat logs on the machine whose logs don't show up in Kibana.

---

<div class="post-metadata">

**Author:** ![MLdz](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@MLdz](https://discuss.elastic.co/u/MLdz)\
**Post date:** [October 18, 2017, 8:36am UTC](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251/3 "2017-10-18T08:36:44Z")

</div>

In the filebeat logs , no problem, just :

_2017-10-18T10:30:13+02:00 INFO No non-zero metrics in the last 30s_

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 18, 2017, 10:56am UTC](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251/4 "2017-10-18T10:56:28Z")

</div>

And what does the Filebeat configuration look like? Have you tried bumping the log level to get more clues?

---

<div class="post-metadata">

**Author:** ![MLdz](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@MLdz](https://discuss.elastic.co/u/MLdz)\
**Post date:** [October 18, 2017, 12:36pm UTC](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251/5 "2017-10-18T12:36:26Z")

</div>

```
#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/httpd/*
    #- c:\programdata\elasticsearch\logs\*

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.

#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------#
output.logstash:
  # The Logstash hosts
  hosts: ["192.18.53.12:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
#logging.level: error

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]

```

The configuration of the filebeat, with the host of the ELK stack

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2017, 12:36pm UTC](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251/6 "2017-11-15T12:36:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.