# Send with many filebeat to one beat. "Inputbeat"
**URL:** https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [October 8, 2021, 10:11am UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221 "2021-10-08T10:11:29Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Felix\_Kutscher](https://discuss.elastic.co/u/Felix_Kutscher)
#### Post date: [October 8, 2021, 10:11am UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/1 "2021-10-08T10:11:29Z")
Hello,
situation:
We use Logstash as a forwarder. Many filebeats send to one Logstash. (filebeat--\>forwarder-logstash--\>logstash--\>elastic)
But the logstash is only a forwarder and very unstable.
Now my question:
Is it possible to set a beat with **input beats** and **output logstash** exists?
(filebeat--\>beat-\>logstash--\>Elasticsearch)
I think about a "Inputbeat" with output to Logstash.
---
### Author:  [@zx8086](https://discuss.elastic.co/u/zx8086)
#### Post date: [October 8, 2021, 10:15am UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/2 "2021-10-08T10:15:51Z")
Can you show the configuration files of your current situation to explain in more detail what the problem is and what you are trying to achieve?
---
### Author:  [@Felix\_Kutscher](https://discuss.elastic.co/u/Felix_Kutscher)
#### Post date: [October 8, 2021, 12:03pm UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/3 "2021-10-08T12:03:17Z")
i want to erase the forward-logstash becouse the unstable/"to-big"/sometimes buggy and i think some lightweight beats is better.
(filebeat--\>forwarder-logstash--\>logstash--\>elastic) **now**
(filebeat--\>forwarder-beats--\>logstash--\>elastic) **wish**
forwarder-logstash
Config:
```auto
input {
beats {
port => XXXX
tags => ["filebeat"]
ssl => true
ssl_certificate_authorities => ["/path/to"]
ssl_certificate => "/path/to"
ssl_key => "/path/to"
ssl_verify_mode => "force_peer"
client_inactivity_timeout => 600
tls_min_version => 1.2
}
output {
lumberjack {
codec => json
hosts => ["XXXXX"]
port => XXXX
ssl_certificate => "/path/to"
}
```
---
### Author:  [@zx8086](https://discuss.elastic.co/u/zx8086)
#### Post date: [October 8, 2021, 12:20pm UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/4 "2021-10-08T12:20:39Z")
Not sure what you are trying to solve.
@leandrojmp has good advice on using multiple pipelines
> **[logstash: using multiple pipelines](https://web.leandrojmp.com/posts/en/2021/03/logstash-multiple-pipelines)**
>
> example of how to use multiple pipelines in logstash
and then there is official documentation on pipeline to pipeline communication.
> **[Pipeline-to-Pipeline Communication | Logstash Reference \[7.15\] | Elastic](https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html)**
Trying to understand why you need your current set-up, the reasoning behind that setup and why it was built that way.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 8, 2021, 12:49pm UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/5 "2021-10-08T12:49:04Z")
It is not possible, beats only has outputs to Elasticsearch, logstash, kafka, redis, file and console.
I'm trying to understand your scenario, why the need for the forwarder.
You have multiple beats in different machines that are allowed to send data only to this logstash forwarder and then this logstash forwarder has access to the other logstash machine?
Also, working as a forwarder is a simple thing for logstash to do, if it is not working well and seems unstable, maybe there is some underlying issue causing this. How did arrived at the conclusion that it is logstash that is unstable? What do you have in the logs?
What are the versions of filebeat and logstash?
---
### Author:  [@Felix\_Kutscher](https://discuss.elastic.co/u/Felix_Kutscher)
#### Post date: [October 11, 2021, 2:32pm UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/6 "2021-10-11T14:32:30Z")
For some special network-reasons we need a one-one connection. So we used this:
> **[Logstash-to-Logstash Communication | Logstash Reference \[7.15\] | Elastic](https://www.elastic.co/guide/en/logstash/current/ls-to-ls.html)**
But we are not happy with the output plugin.
> **[GitHub - logstash-plugins/logstash-output-lumberjack](https://github.com/logstash-plugins/logstash-output-lumberjack)**
>
> Contribute to logstash-plugins/logstash-output-lumberjack development by creating an account on GitHub.
We have still the error message: [Improve "Whoa we shouldn't get this frame" message · Issue #22 · logstash-plugins/logstash-output-lumberjack · GitHub](https://github.com/logstash-plugins/logstash-output-lumberjack/issues/22)
Version: 7.14 Logstash
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 11, 2021, 3:57pm UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/7 "2021-10-11T15:57:06Z")
> [@Felix\_Kutscher](#):
>
> For some special network-reasons we need a one-one connection.
Yeah, that is what I thought could be the reason.
There is not much to do as Filebeat has limited output options.
You could try to remove the logstash forwarder and use a proxy instead, for example HAProxy as a SSL Passthrough with tcp mode.
Or you could use Kafka as a message broker in some place.
---
### Author:  [@Felix\_Kutscher](https://discuss.elastic.co/u/Felix_Kutscher)
#### Post date: [October 12, 2021, 9:11am UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/8 "2021-10-12T09:11:09Z")
Thanks leandorjmp - Or we develop a forward-beats 😉
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 9, 2021, 11:11am UTC](https://discuss.elastic.co/t/send-with-many-filebeat-to-one-beat-inputbeat/286221/9 "2021-11-09T11:11:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.