# Two filebeat servers setting output to same elasticsearch **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [May 14, 2020, 5:07am UTC](https://discuss.elastic.co/t/two-filebeat-servers-setting-output-to-same-elasticsearch/232550 "2020-05-14T05:07:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sushma\_bm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sushma_bm/32/51976_2.png) [@sushma\_bm](https://discuss.elastic.co/u/sushma_bm)\ **Post date:** [May 14, 2020, 5:07am UTC](https://discuss.elastic.co/t/two-filebeat-servers-setting-output-to-same-elasticsearch/232550/1 "2020-05-14T05:07:08Z")
My question is, I have filebeat configured in 2 ec2 instance. In one server I have few tools along with filebeat, in another server also few tools, filebeat and elasticsearch is configured. Can I set output of both filebeat to same elasticsearch without getting logstash in middle? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 14, 2020, 5:39am UTC](https://discuss.elastic.co/t/two-filebeat-servers-setting-output-to-same-elasticsearch/232550/2 "2020-05-14T05:39:05Z")
Yes you can. ---
**Author:** ![sushma\_bm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sushma_bm/32/51976_2.png) [@sushma\_bm](https://discuss.elastic.co/u/sushma_bm)\ **Post date:** [May 14, 2020, 11:24am UTC](https://discuss.elastic.co/t/two-filebeat-servers-setting-output-to-same-elasticsearch/232550/3 "2020-05-14T11:24:57Z")
Okay, then how can I differentiate between two filebeat logs? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 14, 2020, 11:22pm UTC](https://discuss.elastic.co/t/two-filebeat-servers-setting-output-to-same-elasticsearch/232550/4 "2020-05-14T23:22:52Z")
They will have a source host name in the event, so you can filter on them. ---
**Author:** ![sushma\_bm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sushma_bm/32/51976_2.png) [@sushma\_bm](https://discuss.elastic.co/u/sushma_bm)\ **Post date:** [May 21, 2020, 6:48am UTC](https://discuss.elastic.co/t/two-filebeat-servers-setting-output-to-same-elasticsearch/232550/5 "2020-05-21T06:48:27Z")
Sorry for late reply, I will tell my scenario please explain what I can do to solve the problem. I have 2 ec2 instances. Instance 1 -\> Sonar and nexus are installed, I want to monitor system metrics using merticbeat, sonar and nexus logs using filebeat. Instance 2 -\> Rundeck is installed, same goes here also metricbeat and filebeat for rundeck logs. Instance 3 -\> Elasticsearch and Kibana are installed. So now if I give both instance 1 and instance 2 beats output to ES which is installed in instance 3, will it work? If yes, how can I get different index for beats installed in 2 instances? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 25, 2020, 12:36am UTC](https://discuss.elastic.co/t/two-filebeat-servers-setting-output-to-same-elasticsearch/232550/6 "2020-05-25T00:36:22Z")
Yes that will work. If you want different indices for each host, then you can use the host's name in the index. Check out [https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 22, 2020, 12:36am UTC](https://discuss.elastic.co/t/two-filebeat-servers-setting-output-to-same-elasticsearch/232550/7 "2020-06-22T00:36:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.