I have the following setting in the filebeats.yml:
Two conditions input for logs
filebeat.inputs: - paths: - E: \ log_type1 _ *. Log fields_under_root: true fields: type: type1 - paths: - E: \ log_type2 _ *. Log fields_under_root: true fields: type: type2
And in my logstash I have two pipelines “pipeline_type1.conf” in port 9601 and “pipeline_type2.conf” in port 9602.
I'd like to know if it's possible set in filebeats.yml two outputs like
If (type = ‘type1’) output.logstash: hosts: ["localhost: 9601"] If (type = ‘type2’) output.logstash: hosts: ["localost: 9602"]
Or send all data for both ports, and in the pipeline's filter include an if for each type.
If there is no solution like those, I thought in include one more filebeat agent and each one has its output.
Can you give me a tip how to solve that?