# Multiple filebeats to logstash

**URL:** <https://discuss.elastic.co/t/multiple-filebeats-to-logstash/142628>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 1, 2018, 5:04pm UTC](https://discuss.elastic.co/t/multiple-filebeats-to-logstash/142628 "2018-08-01T17:04:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lcui\_dxc](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\
**Post date:** [August 1, 2018, 5:04pm UTC](https://discuss.elastic.co/t/multiple-filebeats-to-logstash/142628/1 "2018-08-01T17:04:18Z")

</div>

Hello there,

I'm new to ELK on AWS, I have set up an ELK cluster on one node/EC2 instance (may expand later). Also I set up a linux server(EC2 instance) with filebeat and metricbeat running and sending logs and metrics to Logstash. I can see data showing up on Kibana from this Server where filebeat and metricbeat run on.  
Now I have set up filebeat and metricbeat on other EC2 instances(linux and Windows), my questions are:

1. When setting up filebeat and metricbeat on new servers, do I have to re-run  
a. metricbeat/filebeat setup --template -E output.logstash.enabled=false -E .....  
b. metricbeat/filebeat setup --dashboards
2. Do we have to create new indexes on ELK to handle the data from different servers?

Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 1, 2018, 5:11pm UTC](https://discuss.elastic.co/t/multiple-filebeats-to-logstash/142628/2 "2018-08-01T17:11:34Z")

</div>

> [@lcui\_dxc](#):
>
> When setting up filebeat and metricbeat on new servers, do I have to re-run

It's not necessary assuming it's the same Beat version.

> [@lcui\_dxc](#):
>
> Do we have to create new indexes on ELK to handle the data from different servers?

No, I'd stick to the defaults and let each Filebeat write to the `filebeat-<beat.version>-yyyy.mm.dd` index and do the same for metricbeat.

As you begin to scale up you might want to adjust the number of shards used for the index depending on the amount data you index on a daily basis. [How many shards should I have in my Elasticsearch cluster? | Elastic Blog](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)

---

<div class="post-metadata">

**Author:** ![lcui\_dxc](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\
**Post date:** [August 1, 2018, 5:47pm UTC](https://discuss.elastic.co/t/multiple-filebeats-to-logstash/142628/3 "2018-08-01T17:47:40Z")

</div>

Thanks a lot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2018, 5:47pm UTC](https://discuss.elastic.co/t/multiple-filebeats-to-logstash/142628/4 "2018-08-29T17:47:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.