Setup of logstash and filebeat on central server

Elastic Stack Logstash
1

We are setting up elasticsearch, kibana, logstash and filebeats on a server to analyse log files from many applications. Due to reasons* each application log file ens up in a separate directory on the server. We have about 20.

  1. As I understand we can run a logstash pipeline config file for each application log file. That will be one logstash instance running with 20 pipelines in parallel and each pipeline will need its own port beat port. Please confirm that this is correct?

  2. Can we have one filebeat instance running or do we need one for each pipeline/logfile?

  3. Is this architecture ok or do you see any major down sides?

Thank you!

  • There are different vendors responsible for different applications and they run a cross many different OS and many of them will not or can't install anything like filebeats.
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.