# Send logs From Filebeat to 2 different group logstash servers simultaneously

**URL:** <https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-group-logstash-servers-simultaneously/353548>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 19, 2024, 8:17am UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-group-logstash-servers-simultaneously/353548 "2024-02-19T08:17:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\
**Post date:** [February 19, 2024, 8:17am UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-group-logstash-servers-simultaneously/353548/1 "2024-02-19T08:17:40Z")

</div>

I need to send logs From Filebeat to 2 different group logstash servers simultaneously

Group A: Single logstash server with certificate\_A and CA\_A  
Group B: 3 logstash servers run in loadbalance mode. with certificate\_B and CA\_B

May I know is it possible to get the job done by changing the filebeat.yml

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 19, 2024, 12:02pm UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-group-logstash-servers-simultaneously/353548/2 "2024-02-19T12:02:45Z")

</div>

> [@Frances\_Chu](#):
>
> May I know is it possible to get the job done by changing the filebeat.yml

No, this is not possible, the beats only support one output.

The alternative would be to use a intermediate Logstash that would then be able to send the logs to the two different groups.

---

<div class="post-metadata">

**Author:** ![intrepid1](https://avatars.discourse-cdn.com/v4/letter/i/dbc845/32.png) [@intrepid1](https://discuss.elastic.co/u/intrepid1)\
**Post date:** [February 19, 2024, 1:50pm UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-group-logstash-servers-simultaneously/353548/3 "2024-02-19T13:50:05Z")

</div>

Hi there,

We use Redis between Filebeat and Logstash. We set tags in our log prospectors and send those to individual Redis lists based on the tag and to multiple Redis instances. We then set-up Logtash to read from the multiple Redis servers.

We have ten Logstash instances and 10 Redis servers. We set-up each Logstash server to read from each Redis server. Therefore if we lose one Logstash instance, the other nine can take the strain. Effectively it is a poor man's clustered Logstash.

I am not sure whether this helps but it may give you another angle to look at.

---

<div class="post-metadata">

**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\
**Post date:** [February 20, 2024, 3:54am UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-group-logstash-servers-simultaneously/353548/4 "2024-02-20T03:54:02Z")

</div>

Thanks for the information

---

<div class="post-metadata">

**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\
**Post date:** [February 20, 2024, 3:54am UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-group-logstash-servers-simultaneously/353548/5 "2024-02-20T03:54:36Z")

</div>

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2024, 5:54am UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-group-logstash-servers-simultaneously/353548/6 "2024-03-19T05:54:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
