# Single ELK Agent for Both Infrastructure and Application Management Needs?

**URL:** <https://discuss.elastic.co/t/single-elk-agent-for-both-infrastructure-and-application-management-needs/364004>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring\
**Created:** [July 29, 2024, 6:41pm UTC](https://discuss.elastic.co/t/single-elk-agent-for-both-infrastructure-and-application-management-needs/364004 "2024-07-29T18:41:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![airplay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/airplay/32/136381_2.png) [@airplay](https://discuss.elastic.co/u/airplay)\
**Post date:** [July 29, 2024, 6:41pm UTC](https://discuss.elastic.co/t/single-elk-agent-for-both-infrastructure-and-application-management-needs/364004/1 "2024-07-29T18:41:24Z")

</div>

Hello everyone,

There are two separate departments in the company I work for. One is Infrastructure and the other is Application Management.

Infrastructure says this;  
I only want to access CPU, RAM, Disk, Network metrics and events of Linux servers.

Application Management says this;  
We will provide you the directories of our applications on the servers and we want to be able to observe the logs there from ELK, create alerts and be aware of anomalies.

The problem is this;  
They both use their own ELK Deployments, so there are two different deployments in the ELK Cloud we are using, but I have to install a single agent on the servers.

As far as I searched here, two agents cannot be installed on one server, so what do you suggest?

Do you think this is a reasonable approach?  
To realise the demands of both Infrastructure and Application Management through a single deployment and with a single agent, to present them in separate dashboards and to apply all authorisation transactions through these dashboards.

I look forward to hearing all your opinions on the issue.

Regards,

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 30, 2024, 2:43am UTC](https://discuss.elastic.co/t/single-elk-agent-for-both-infrastructure-and-application-management-needs/364004/2 "2024-07-30T02:43:12Z")

</div>

Hi @airplay Welcome to the community...

Separate outputs are defined per integration is on the Elastic Agent roadmap. Unfortunately, we can not provide a timeframe/release number for that.

You can follow the work if you like

> <https://github.com/elastic/kibana/issues/143905>
>
> There are many legitimate reasons why an operator may need/want to send data fro…m integrations to different outputs within a policy. Some may even need to send datastream to different outputs. Currently we only allow an output to be defined on a per policy basis. In order to support this request the per policy output definition needs to be over-written by the output defined in the integration. Our config should support this already.
> 
> \*\*Use Cases:\*\*
> 
> 1) As an operator, I need my security logs from an agent to be sent to one logstash where as informational logs to be sent to another logstash instance.
> 
> 2) We operate multiple beats on a given system and would like to migrate to using Elastic Agent. For historical and operational reasons these beats are writing data to distinct outputs. Once we migrate over to using Agent, we would like to keep the upstream pipeline intact.

In the meantime, you could pass the data through Logstash and split the stream/telemetry as you like.... i.e. send to separate data to separate elasticsearch