Multiple outputs in the filebeats.yml to the logstash


I have the following setting in the filebeats.yml:
Two conditions input for logs

- paths:
    - E: \ log_type1 _ *. Log
  fields_under_root: true
    type: type1

- paths:
    - E: \ log_type2 _ *. Log
  fields_under_root: true
    type: type2

And in my logstash I have two pipelines “pipeline_type1.conf” in port 9601 and “pipeline_type2.conf” in port 9602.

I'd like to know if it's possible set in filebeats.yml two outputs like

If (type = ‘type1’)
  hosts: ["localhost: 9601"]
If (type = ‘type2’)
  hosts: ["localost: 9602"]

Or send all data for both ports, and in the pipeline's filter include an if for each type.

If there is no solution like those, I thought in include one more filebeat agent and each one has its output.

Can you give me a tip how to solve that?

It is not possible to have two outputs in Filebeat. As a workaround you could run two instaces of it with the appropriate output configuration.

I'll to do that. Thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.