I would like to use multiple filebeat instances, since filebeat doesn’t support multiple outputs and my logs from the same host are too different(so I would like to send them to different Graylog Inputs).
And it’s too complicated(and it has performance penalty) to handle it on graylog side.
Is there some way I can do it?
This approach is related to this discussion
Yes, that’s possible, simply assign more filebeats configuration to one sidecar. Try to use separate directories for filebeat logs, etc.
Hmm…would you mind to provide more details?
I have several filebeat configurations, but when I select another configuration in System/Sidecars->Administration->Configure->Apply configuration menu it just replaces first one, not added.
You need to create second Log Collector (e.g clone of first one) and then create new Configuration for this Log collector. Finally select new Log Collector in Administration and assing newly created configuration for it.
Sorry for bothering you again, but I’m really confused.
Are we really talking about standard sidecar/filebeat usecase + Graylog 3.3?
Because there is no any Create Log Collector button in my version.
I just set server_url in sidecar.yml and then Graylog added it automatically and then I selected filebeat checkbox, that’s it.
Could you please describe it in details step-by-step?
Ah, I think I got it, just needed to scroll down 
Will give it a try
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.