Multiple outputs in the filebeats.yml to the logstash

Elastic Stack Beats
1

Hello,

I have the following setting in the filebeats.yml:
Two conditions input for logs

filebeat.inputs:
- paths:
    - E: \ log_type1 _ *. Log
  fields_under_root: true
  fields:
    type: type1

- paths:
    - E: \ log_type2 _ *. Log
  fields_under_root: true
  fields:
    type: type2

And in my logstash I have two pipelines “pipeline_type1.conf” in port 9601 and “pipeline_type2.conf” in port 9602.

I'd like to know if it's possible set in filebeats.yml two outputs like

If (type = ‘type1’)
output.logstash:
  hosts: ["localhost: 9601"]
If (type = ‘type2’)
output.logstash:
  hosts: ["localost: 9602"]

Or send all data for both ports, and in the pipeline's filter include an if for each type.

If there is no solution like those, I thought in include one more filebeat agent and each one has its output.

Can you give me a tip how to solve that?

2

It is not possible to have two outputs in Filebeat. As a workaround you could run two instaces of it with the appropriate output configuration.

1 Like
3

I'll to do that. Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.