# Multiple outputs in the filebeats.yml to the logstash

**URL:** https://discuss.elastic.co/t/multiple-outputs-in-the-filebeats-yml-to-the-logstash/208603
**Category:** Beats
**Tags:** filebeat
**Created:** [November 20, 2019, 3:13am UTC](https://discuss.elastic.co/t/multiple-outputs-in-the-filebeats-yml-to-the-logstash/208603 "2019-11-20T03:13:24Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Thiago\_Paiva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago_paiva/32/52326_2.png) [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)
#### Post date: [November 20, 2019, 3:13am UTC](https://discuss.elastic.co/t/multiple-outputs-in-the-filebeats-yml-to-the-logstash/208603/1 "2019-11-20T03:13:24Z")

</div>

Hello,

I have the following setting in the filebeats.yml:  
Two conditions input for logs

```
filebeat.inputs:
- paths:
    - E: \ log_type1 _ *. Log
  fields_under_root: true
  fields:
    type: type1

- paths:
    - E: \ log_type2 _ *. Log
  fields_under_root: true
  fields:
    type: type2

```

And in my logstash I have two pipelines “pipeline\_type1.conf” in port 9601 and “pipeline\_type2.conf” in port 9602.

I'd like to know if it's possible set in filebeats.yml two outputs like

```
If (type = ‘type1’)
output.logstash:
  hosts: ["localhost: 9601"]
If (type = ‘type2’)
output.logstash:
  hosts: ["localost: 9602"]

```

Or send all data for both ports, and in the pipeline's filter include an if for each type.

If there is no solution like those, I thought in include one more filebeat agent and each one has its output.

Can you give me a tip how to solve that?

---

<div class="post-metadata">

### Author: ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [November 20, 2019, 7:09am UTC](https://discuss.elastic.co/t/multiple-outputs-in-the-filebeats-yml-to-the-logstash/208603/2 "2019-11-20T07:09:12Z")

</div>

It is not possible to have two outputs in Filebeat. As a workaround you could run two instaces of it with the appropriate output configuration.

---

<div class="post-metadata">

### Author: ![Thiago\_Paiva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago_paiva/32/52326_2.png) [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)
#### Post date: [November 20, 2019, 6:00pm UTC](https://discuss.elastic.co/t/multiple-outputs-in-the-filebeats-yml-to-the-logstash/208603/3 "2019-11-20T18:00:48Z")

</div>

I'll to do that. Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 18, 2019, 6:00pm UTC](https://discuss.elastic.co/t/multiple-outputs-in-the-filebeats-yml-to-the-logstash/208603/4 "2019-12-18T18:00:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.