Replace rsyslog with Filebeat?

[ajhstn]

Can Filebeat be used as a simple rsyslog replacement?

Can i have 3 udp inputs on 10514, 10515 and 10516, and each of them outputting to ES to 3 different indices?

[pmercado (PM)]

Hi @ajhstn,

reading docs it looks possible.
Have you tried adding multiple syslog inputs?

can this help on using different indexes?

Change index per pipeline

I'm very new to elasticsearch, so I may be approaching this problem incorrectly. I've got a couple logs with different log formats. It's pretty easy to create a pipeline with a grok pattern for each, but I'd like to send each log type to a different index. I assume this is a common pattern. How do other folks handle this? Ideally I'd like to do this with just filebeat and elasticsearch.