# Running multiple filebeat instances

**URL:** <https://discuss.elastic.co/t/running-multiple-filebeat-instances/48995>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 2, 2016, 8:13pm UTC](https://discuss.elastic.co/t/running-multiple-filebeat-instances/48995 "2016-05-02T20:13:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![reinier](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@reinier](https://discuss.elastic.co/u/reinier)\
**Post date:** [May 2, 2016, 8:13pm UTC](https://discuss.elastic.co/t/running-multiple-filebeat-instances/48995/1 "2016-05-02T20:13:48Z")

</div>

Hi,

I am currently using Filebeat to send both NGINX and Syslog towards an ELK stack, which works perfectly. Nice! Now I am trying to add OSSEC to the equation. The OSSEC files are in JSON format, while the other logs are not. This creates a problem at Logstash Input, working with two codec types on the same inbound TCP port.

I did read some comments about running two Filebeat instances. Meaning I could then use different Filebeat configs and therefore two different TCP ports to output towards Logstash. Not so much of a problem for me. The only question to a Linux newbie is how to actually run two instances in daemon mode? I am guessing that would entail copying the provided script and amending it to create a second instance? Or is there another way?

Thanks for your excellent work, this is a great help to us here!

Regards,  
Reinier

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 2, 2016, 9:35pm UTC](https://discuss.elastic.co/t/running-multiple-filebeat-instances/48995/2 "2016-05-02T21:35:00Z")

</div>

I don't think you need 2 instances. Just configure 2 prospectors. With version 5.0 alpha1(or alpha2) the json can even be parsed by filebeat (if 1 json log per line).

In every prospector one can use additional fields/tags for use with logstash. e.g. (filebeat versions 1.x):

```auto
filebeat:
  prospectors:
    - input_type: log
      paths:
         - ...
      fields_under_root: true
      fields:
        json: false
    - input_type: log
      paths:
         - ...
      fields_under_root: true
      fields:
        json: true

```

Then I can use json filter in logstash:

```auto
filter{
    if [json] {
        json {
            source => "message"
        }
    }
}

```

---

<div class="post-metadata">

**Author:** ![reinier](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@reinier](https://discuss.elastic.co/u/reinier)\
**Post date:** [May 2, 2016, 11:55pm UTC](https://discuss.elastic.co/t/running-multiple-filebeat-instances/48995/3 "2016-05-02T23:55:36Z")

</div>

Flawless victory, Steffen 🙂 Just finished reconfiguring our servers. Very nice. Off to catch some shut-eye. Thanks a lot for your help!

Cheers,  
Reinier

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:52pm UTC](https://discuss.elastic.co/t/running-multiple-filebeat-instances/48995/4 "2017-07-05T21:52:33Z")

</div>