0
votes

So I'm reading in several different file types using Filebeat. I set the document_type for each kind of file I am harvesting. My problem is that I want to send most of these file types to Logstash, but there are certain types I wish to send directly to Elasticsearch.

Is it possible to select the output depending on file type? I know multiple outputs are allowed, but this sends all the data into both elasticsearch and logstash so it's going to get inserted into Elasticsearch twice, which will take up too much space. Thanks!

1
You can run a instance of filebeat for each endpoint.codemonkey

1 Answers

1
votes

Filebeat ships events to one endpoint, all routing should be done in Logstash.