# Sending logstash data to multiple elastic instances/clusters **URL:** \ **Category:** Logstash\ **Created:** [June 30, 2016, 11:58pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482 "2016-06-30T23:58:05Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![zoplex](https://avatars.discourse-cdn.com/v4/letter/z/bc8723/32.png) [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Post date:** [June 30, 2016, 11:58pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/1 "2016-06-30T23:58:05Z")
Is it possible to send same data records/events from Logstash output section to two different elastic targets - one 2-node cluster and another separate elastic instance ? Second target would be for testing - so that same data feed is used for that. Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 1, 2016, 12:46am UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/2 "2016-07-01T00:46:51Z")
Yep, just have multiple outputs for the events. ---
**Author:** ![zoplex](https://avatars.discourse-cdn.com/v4/letter/z/bc8723/32.png) [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Post date:** [July 1, 2016, 1:45am UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/3 "2016-07-01T01:45:54Z")
Great - thank you ---
**Author:** ![zoplex](https://avatars.discourse-cdn.com/v4/letter/z/bc8723/32.png) [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Post date:** [July 1, 2016, 3:18pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/4 "2016-07-01T15:18:01Z")
.. forgot to ask - if there are two outputs - one for each elastic target - what if one of those is down? Will that stop the data from getting into the other one - is it 'all-or-none' output from Logstash or will events still flow to the available elastic cluster if the other one is down? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 1, 2016, 10:16pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/5 "2016-07-01T22:16:54Z")
It's an all or nothing thing. ---
**Author:** ![zoplex](https://avatars.discourse-cdn.com/v4/letter/z/bc8723/32.png) [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Post date:** [July 1, 2016, 11:02pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/6 "2016-07-01T23:02:52Z")
Got it - thank you. ---
**Author:** ![zoplex](https://avatars.discourse-cdn.com/v4/letter/z/bc8723/32.png) [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Post date:** [February 8, 2017, 5:33pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/7 "2017-02-08T17:33:06Z")
I would like to reopen this question - with 5 x ES, did this change? All or none is not practical when feeding same data to prod and non-prod (for testing/QA for example) since the availability is different. If not, could that be done at filebeat level? Thanks ---
**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Post date:** [February 8, 2017, 7:56pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/8 "2017-02-08T19:56:49Z")
You can have multiple output configs. You can then use IF statements to decided what gets to the output target. Mine looks like this: ``` output { if [pipeline] =~ /(?i)(####|####)/ { # elasticsearch { # hosts => ["http://x.x.x.x:9200","http://x.x.x.x:9200","http://x.x.x.x:9200","http://x.x.x.x:9200"] # index => "logstash-%{+YYYY.MM.dd}" # } } } ``` I have another one, with the same setup, just different values in the IF statement. ---
**Author:** ![zoplex](https://avatars.discourse-cdn.com/v4/letter/z/bc8723/32.png) [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Post date:** [February 8, 2017, 10:15pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/9 "2017-02-08T22:15:23Z")
Thank you, I am assuming that within one 'hosts' line all the listed target hosts are all-or-none? Those 4 you listed in this IF ... Then using multiple IF blocks one could more flexibly control different target groups, that are not necessary equally available ... Thank you ---
**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Post date:** [February 8, 2017, 10:44pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/10 "2017-02-08T22:44:50Z")
If you define multiple targets within a single output, the data shipped off is round robin load balanced. In my case, that config will send log A to the first IP, log B, to the second IP, log C to the third IP, and log D to the forth IP. Then log E will go back to the first IP. If you want the same data, in two places, you have to define two separate outputs. ---
**Author:** ![zoplex](https://avatars.discourse-cdn.com/v4/letter/z/bc8723/32.png) [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Post date:** [February 9, 2017, 2:57pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/11 "2017-02-09T14:57:41Z")
Thank you Jason! ---
**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Post date:** [February 9, 2017, 3:03pm UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/12 "2017-02-09T15:03:43Z")
Not a problem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/sending-logstash-data-to-multiple-elastic-instances-clusters/54482/13 "2017-07-06T04:28:43Z")