# Using Filebeat dedicated and send logs to different IP

**URL:** <https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 6, 2018, 5:21am UTC](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823 "2018-07-06T05:21:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wahyu](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@Wahyu](https://discuss.elastic.co/u/Wahyu)\
**Post date:** [July 6, 2018, 5:21am UTC](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823/1 "2018-07-06T05:21:22Z")

</div>

Hi,  
I am a newcomer here especially logs monitory system. I am learning to build log system.  
Basically, i choose the opensource 🙂

So, i have 2 VPS right now.  
In the first VPS (x.x.x.x), there are Graylog v2.4, Elasticsearch v5.6.9, and MongoDB v3.0.15 and in the second VPS (x.x.x.y), there are Apache or Nginx and Filebeat.

If i want to send Apache's or Nginx's logs using Filebeat into the first VPS, is it possible ?

For example, i will use Apache.

> filebeat.modules:
> 
> - module: apache2
> - type: log  
> paths:  
> - /var/log/apache2/myweb.log
> 
> output.elasticsearch  
> hosts: ["x.x.xx:9200"]

is it true ?  
Sorry, i am so confused. I read so many example filebeat configurations in Google but don't understand how they do that

Sorry, if my questions is very fool, i am trying to understand by myself but i need guidance. No bully please 🙂

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 6, 2018, 10:55am UTC](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823/2 "2018-07-06T10:55:12Z")

</div>

Hi,

Yes, that is exactly how Beats are meant to be used. You run them in the host where the data to collect resides and usually send the output to a dedicated server running Elasticsearch.

So in your case you only need to add the IP or hostname for VPS#1 in the hosts field in your elasticsearch output configuration:

```auto
output.elasticsearch:
   hosts: ["x.x.x.x:9200"]

```

Note that in your example you're missing a colon (`:`) at the end of the `output.elasticsearch:` line. I suggest you use the `filebeat test config` command to make sure everything is fine.

Don't hesitate to use this forum to post any more questions you may have 🙂

---

<div class="post-metadata">

**Author:** ![Wahyu](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@Wahyu](https://discuss.elastic.co/u/Wahyu)\
**Post date:** [July 6, 2018, 1:56pm UTC](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823/3 "2018-07-06T13:56:01Z")

</div>

Hello, thank you very much for your help.  
My Filebeat version is 6.3.1 (Latest update)  
So, i follow these steps to send apache2 logs [Apache module | Beats](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-apache2.html)

> $ filebeat modules enable apache2  
> And then, i go to /etc/filebeat/modules.d/apache2.yml

```
- module: apache2

```

# Access logs

access:  
enabled: true

```
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
var.paths: /var/log/apache2/access.log

```

# Error logs

error:  
enabled: true

```
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
var.paths: /var/log/apache2/error.log

```

And then i type this command

> filebeat setup -e

I got errors

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee460af872594ccece06cd96e123f05af4b6bf4b.png)

I have set my output.elasticsearch like this

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa6ffb51f3f5f9cd1bc691679b49f600da3201da.png) and gave comment (#) setup.kibana and restarted filebeat (service filebeat restart) but still got same error. Error creating Kibana.

Should i put output.elasticsearch into apache2.yml (modules.d) ? or it should be put in filebeat.yml ? and what is filebeat.reference.yml ? I noticed output.elasticsearch in filebeat.reference.yml.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 6, 2018, 2:04pm UTC](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823/4 "2018-07-06T14:04:42Z")

</div>

Only one output is possible and it must be in the main configuration file (filebeat.yml).

---

<div class="post-metadata">

**Author:** ![Wahyu](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@Wahyu](https://discuss.elastic.co/u/Wahyu)\
**Post date:** [July 6, 2018, 2:37pm UTC](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823/5 "2018-07-06T14:37:10Z")

</div>

Ok. It means my config should be right. But, after service filebeat restart. The terminal still tell the error that kibana is needed 😢

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2018, 2:37pm UTC](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823/6 "2018-08-03T14:37:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.