{"id":7276,"date":"2020-10-10T22:43:58","date_gmt":"2020-10-10T19:43:58","guid":{"rendered":"https:\/\/kifarunix.com\/?p=7276"},"modified":"2024-03-14T23:25:08","modified_gmt":"2024-03-14T20:25:08","slug":"run-multiple-filebeat-instances-in-linux","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/run-multiple-filebeat-instances-in-linux\/","title":{"rendered":"How to run Multiple Filebeat Instances in Linux"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to run multiple filebeat instances in Linux system. <a aria-label=\"Filebeat (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/www.elastic.co\/beats\/filebeat\" target=\"_blank\" rel=\"noreferrer noopener\">Filebeat<\/a> is one of the Elastic beat and is a lightweight shipper for collecting, forwarding and centralizing event log data. It is installed as an agent on the servers you are collecting logs from. It can forward the logs it is collecting to either Elasticsearch or Logstash for direct indexing or for further processing before being sent to Elasticsearch for indexing respectively.<\/p>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li><a href=\"#running-multiple-filebeat-instances-in-linux\">Running Multiple Filebeat Instances in Linux<\/a><ul><li><a href=\"#install-filebeat-on-linux-systems\">Install Filebeat on Linux Systems<\/a><\/li><li><a href=\"#run-multiple-filebeat-instances-in-linux\">Run Multiple Filebeat Instances in Linux<\/a><ul><li><a href=\"#run-multiple-filebeat-instances-in-linux-using-filebeat-god\">Run Multiple Filebeat Instances in Linux using Filebeat-god<\/a><ul><li><a href=\"#installing-filebeat-god\">Installing Filebeat-god<\/a><\/li><li><a href=\"#configure-elasticsearch-output\">Configure Elasticsearch output<\/a><\/li><li><a href=\"#configure-logstash-output\">Configure Logstash Output<\/a><\/li><\/ul><\/li><li><a href=\"#run-multiple-filebeat-instances-in-linux-using-systemd\">Run Multiple Filebeat Instances in Linux using Systemd<\/a><\/li><\/ul><\/li><li><a href=\"#reference\">Reference<\/a><\/li><li><a href=\"#related-tutorials\">Related Tutorials<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"running-multiple-filebeat-instances-in-linux\">Running Multiple Filebeat Instances in Linux<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"install-filebeat-on-linux-systems\">Install Filebeat on Linux Systems<\/h3>\n\n\n\n<p>In our previous tutorials, we have discussed how to install single instance Filebeat.<\/p>\n\n\n\n<p><a aria-label=\"Install and Configure Filebeat on Ubuntu 20.04 (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-elastic-elk-stack-on-ubuntu-20-04\/#install-filebeat-ubuntu-20.04\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install and Configure Filebeat on Ubuntu 20.04<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-and-configure-filebeat-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install and Configure Filebeat on CentOS 8<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-filebeat-on-fedora-30-fedora-29-centos-7\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install Filebeat on Fedora 30\/Fedora 29\/CentOS 7<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-and-configure-filebeat-7-on-ubuntu-18-04-debian-9-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install and Configure Filebeat 7 on Ubuntu 18.04\/Debian 9.8<\/a><\/p>\n\n\n\n<p>In all the above tutorials, we have had a single instance of Filebeat running on a system and either sending log data directly to Elasticsearch or to Logstash for further processing before being sent to Elasticsearch.<\/p>\n\n\n\n<p>There comes a times when you may want to sent system logs to multiple outputs; for example sent some logs directly to Elasticsearch while at the same time sending some other logs directly to Logstash for processing.<\/p>\n\n\n\n<p>Thus, in this tutorial, let us see how possible it is to install and run multiple filebeat instances in Linux system in order to be able to sent the data into multiple outputs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"run-multiple-filebeat-instances-in-linux\">Run Multiple Filebeat Instances in Linux<\/h3>\n\n\n\n<p>There are multiple ways in which you can install and run multiple filebeat instances in Linux. Some of these include;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"#run-multiple-filebeat-with-filebeat-god\" class=\"rank-math-link\">Run Multiple Filebeat Instances in Linux using Filebeat-god<\/a><\/li>\n\n\n\n<li><a href=\"#run-multiple-filebeat-instances-using-systemd\" class=\"rank-math-link\">Run Multiple Filebeat Instances in Linux using systemd<\/a><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"run-multiple-filebeat-instances-in-linux-using-filebeat-god\">Run Multiple Filebeat Instances in Linux using Filebeat-god<\/h4>\n\n\n\n<p><a aria-label=\"Go daemon (opens in a new tab)\" rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/tsg\/go-daemon\" target=\"_blank\" class=\"rank-math-link\">Go daemon<\/a> (or just&nbsp;<strong>god<\/strong>) <em>is a utility that is used to &#8220;daemonize&#8221; Go programs that originally only run in foreground and write logs to the console.<\/em> <strong><code>Filebeat-god (Filebeat Go daemon)<\/code><\/strong> is therefore a utility that is used to daemonize the Filebeat processes that would otherwise run on foreground.<\/p>\n\n\n\n<p><strong>Just to note that this guide has been tested with Ubuntu 20.04 and CentOS 8. It should however work on other systems as well, I guess, -:).<\/strong><\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"installing-filebeat-god\">Installing Filebeat-god<\/h5>\n\n\n\n<p>Whenever Filebeat is installed, Filebeat-god is installed along with it and usually resides in same place as the Filebeat binary under <code><strong>\/usr\/share\/filebeat\/bin<\/strong><\/code> directory.<\/p>\n\n\n\n<p>To locate Filebeat-god binary, simply use find command as follows;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">find \/ -iname filebeat-god<\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/share\/filebeat\/bin\/filebeat-god<\/code><\/pre>\n\n\n\n<p>Now, by default, Filebeat uses the following paths;<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Type<\/th><th>Description<\/th><th>Location<\/th><\/tr><\/thead><tbody><tr><td><strong>home<\/strong><\/td><td>Home of the Filebeat installation.<\/td><td><code>\/usr\/share\/filebeat<\/code><\/td><\/tr><tr><td><strong>bin<\/strong><\/td><td>The location for the binary files.<\/td><td><code>\/usr\/share\/filebeat\/bin<\/code><\/td><\/tr><tr><td><strong>config<\/strong><\/td><td>The location for configuration files.<\/td><td><code>\/etc\/filebeat<\/code><\/td><\/tr><tr><td><strong>data<\/strong><\/td><td>The location for persistent data files.<\/td><td><code>\/var\/lib\/filebeat<\/code><\/td><\/tr><tr><td><strong>logs<\/strong><\/td><td>The location for the logs created by Filebeat.<\/td><td><code>\/var\/log\/filebeat<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Assuming, you would like to forward syslog and system authentication events directly to Elasticsearch using system module while you want to sent other custom logs to Logstash for further processing before sending to Elasticsearch, then you have to run the Filebeat processes using Filebeat-god, <code>\/usr\/share\/filebeat\/bin\/filebeat-god<\/code>, as follow;<\/p>\n\n\n\n<p>Create a copy of the Filebeat configuration file.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cp -r \/etc\/filebeat{,-elasticsearch}<\/pre>\n\n\n\n<p>This command creates an <code>\/etc\/filebeat<\/code>-org directory.<\/p>\n\n\n\n<p>So we now have these FIlebeat configuration directories;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ls \/etc\/filebeat*<\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\/etc\/filebeat:\nfields.yml  filebeat.reference.yml  filebeat.yml  modules.d\n\n\/etc\/filebeat-elasticsearch:\nfields.yml  filebeat.reference.yml  filebeat.yml  modules.d\n<\/code><\/pre>\n\n\n\n<p>Let us collect <strong>syslog<\/strong> and <strong>authentication<\/strong> logs using <code>\/etc\/filebeat-elasticsearch<\/code> configs and forward to Elasticsearch. Enabling system module;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cp \/etc\/filebeat-elasticsearch\/modules.d\/system.yml{.disabled,}<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"configure-elasticsearch-output\">Configure Elasticsearch output<\/h5>\n\n\n\n<pre class=\"wp-block-preformatted\">vim \/etc\/filebeat-elasticsearch\/filebeat.yml<\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>...\n# ---------------------------- Elasticsearch Output ----------------------------\noutput.elasticsearch:\n  # Array of hosts to connect to.\n  hosts: [\"192.168.57.30:9200\"]\n...\n<\/code><\/pre>\n\n\n\n<p>Save and exit the config.<\/p>\n\n\n\n<p>Verify if connection to Elasticsearch can be established by running Filebeat in debug mode;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>filebeat -e \\\n\t--path.config \/etc\/filebeat-elasticsearch \\\n\t--path.home \/usr\/share\/filebeat \\\n\t--path.data \/var\/lib\/filebeat-elasticsearch\n<\/code><\/pre>\n\n\n\n<p>If all is well, you should see Elasticsearch connection being established.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>...\n2020-11-24T19:47:12.332Z\tINFO\t[index-management]\tidxmgmt\/std.go:298\tLoaded index template.\n2020-11-24T19:47:12.333Z\tINFO\t[index-management]\tidxmgmt\/std.go:309\tWrite alias successfully generated.\n<strong>2020-11-24T19:47:12.333Z\tINFO\t[publisher_pipeline_output]\tpipeline\/output.go:151\tConnection to backoff(elasticsearch(http:\/\/192.168.57.30:9200)) established<\/strong>\n<\/code><\/pre>\n\n\n\n<p>Next, stop Filebeat running in debug mode and start it as daemon using Filebeat-god as follows;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\/usr\/share\/filebeat\/bin\/filebeat-god -n \\\n\t-p \/var\/run\/filebeat-elasticsearch.pid \\\n\t-r \/ \\\n\t-- \/usr\/share\/filebeat\/bin\/filebeat \\\n\t--path.config \/etc\/filebeat-elasticsearch \\\n\t--path.home \/usr\/share\/filebeat \\\n\t--path.data \/var\/lib\/filebeat-elasticsearch \\\n\t--path.logs \/var\/log\/filebeat-elasticsearch\n<\/code><\/pre>\n\n\n\n<p>Verify if Filebeat is now running as daemon;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ps aux | grep filebeat | grep -v grep<\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>root      121377  0.0  0.0   9300   636 pts\/1    S    20:14   0:00 \/usr\/share\/filebeat\/bin\/filebeat-god -n -p \/var\/run\/filebeat-elasticsearch.pid -r \/ -- \/usr\/share\/filebeat\/bin\/filebeat --path.config \/etc\/filebeat-elasticsearch --path.home \/usr\/share\/filebeat --path.data \/var\/lib\/filebeat-elasticsearch --path.logs \/var\/log\/filebeat-elasticsearch\nroot      121378  4.8  2.0 1609528 127224 pts\/1  SLl  20:14   0:02 \/usr\/share\/filebeat\/bin\/filebeat --path.config \/etc\/filebeat-elasticsearch --path.home \/usr\/share\/filebeat --path.data \/var\/lib\/filebeat-elasticsearch --path.logs \/var\/log\/filebeat-elasticsearch\n<\/code><\/pre>\n\n\n\n<p>Tailing the logs;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">tail -f \/var\/log\/filebeat-elasticsearch\/filebeat<\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>...\n2020-11-25T17:22:30.532Z\tINFO\ttemplate\/load.go:97\tTemplate filebeat-7.10.0 already exists and will not be overwritten.\n2020-11-25T17:22:30.532Z\tINFO\t[index-management]\tidxmgmt\/std.go:298\tLoaded index template.\n2020-11-25T17:22:30.533Z\tINFO\t[index-management]\tidxmgmt\/std.go:309\tWrite alias successfully generated.\n<strong>2020-11-25T17:22:30.536Z\tINFO\t[publisher_pipeline_output]\tpipeline\/output.go:151\tConnection to backoff(elasticsearch(http:\/\/192.168.57.30:9200)) established<\/strong>\n<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"configure-logstash-output\">Configure Logstash Output<\/h5>\n\n\n\n<p>Now, if you want to collect some other logs on the same system and send directly to Logstash for further processing instead of sending to Elasticsearch, simply create a separate Filebeat configuration file as follows;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cp -r \/etc\/filebeat{,-logstash}<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">vim \/etc\/filebeat-logstash\/filebeat.yml<\/pre>\n\n\n\n<p>Specify the logs file to read and sent data to Logstash. In this example, we are collecting wordpress logs and forward to Logstash for processing.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code># ============================== Filebeat inputs ===============================\n\nfilebeat.inputs:\n- type: log\n\n  # Change to true to enable this input configuration.\n  enabled: true\n\n  # Paths that should be crawled and fetched. Glob based paths.\n  paths:\n    - \/var\/log\/wordpress\/kifarunix-demo.com.log\n...\n<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>...\n# ================================== Outputs ===================================\n\n# Configure what output to use when sending the data collected by the beat.\n\n# ---------------------------- Elasticsearch Output ----------------------------\n#output.elasticsearch:\n  # Array of hosts to connect to.\n  #hosts: [\"192.168.57.30:9200\"]\n...\n...\n<strong># ------------------------------ Logstash Output -------------------------------\noutput.logstash:\n  # The Logstash hosts\n  hosts: [\"192.168.57.30:5044\"]\n...<\/strong>\n<\/code><\/pre>\n\n\n\n<p>Save and exit the configuration file.<\/p>\n\n\n\n<p>Run Filebeat in debug mode using the custom Filebeat configuration for the logstash created above.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>filebeat -e \\\n\t--path.config \/etc\/filebeat-logstash\/ \\\n\t--path.home \/usr\/share\/filebeat \\\n\t--path.data \/var\/lib\/filebeat-logstash\n<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>...\n2020-11-25T18:06:30.298Z\tINFO\tlog\/harvester.go:302\tHarvester started for file: \/var\/log\/wordpress\/kifarunix-demo.com.log\n2020-11-25T18:06:33.300Z\tINFO\t[add_cloud_metadata]\tadd_cloud_metadata\/add_cloud_metadata.go:89\tadd_cloud_metadata: hosting provider type not detected.\n2020-11-25T18:06:34.302Z\tINFO\t[publisher_pipeline_output]\tpipeline\/output.go:143\tConnecting to backoff(async(tcp:\/\/192.168.57.30:5044))\n2020-11-25T18:06:34.303Z\tINFO\t[publisher]\tpipeline\/retry.go:219\tretryer: send unwait signal to consumer\n2020-11-25T18:06:34.304Z\tINFO\t[publisher]\tpipeline\/retry.go:223\t  done\n2020-11-25T18:06:34.305Z\tINFO\t[publisher_pipeline_output]\tpipeline\/output.go:151\tConnection to backoff(async(tcp:\/\/192.168.57.30:5044)) established\n<\/code><\/pre>\n\n\n\n<p>If all is well, run Filebeat instance that sends data to Logstash as daemon;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\/usr\/share\/filebeat\/bin\/filebeat-god -n \\\n\t-p \/var\/run\/filebeat-logstash.pid \\\n\t-r \/ \\\n\t-- \/usr\/share\/filebeat\/bin\/filebeat \\\n\t--path.config \/etc\/filebeat-logstash\/ \\\n\t--path.home \/usr\/share\/filebeat \\\n\t--path.data \/var\/lib\/filebeat-logstash \\\n\t--path.logs \/var\/log\/filebeat-logstash\n<\/code><\/pre>\n\n\n\n<p>Similarly, you can check the process using <strong>ps<\/strong> command.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"run-multiple-filebeat-instances-in-linux-using-systemd\">Run Multiple Filebeat Instances in Linux using Systemd<\/h4>\n\n\n\n<p>For Linux systems that uses Systemd initialization, there is no need even bothering to run multiple Filebeat instances in Linux using Filebeat-god.<\/p>\n\n\n\n<p>Running multiple Filebeat instances in Linux using Systemd is as easy as follows.<\/p>\n\n\n\n<p>Assuming you want to collect various logs and sent to various output, as in the example we used above, then all you need to do is to create a Systemd service unit for a Filebeat collecting logs on each specific log file.<\/p>\n\n\n\n<p>An example to create a Filebeat to sent logs to Elasticsearch based on example configuration file above;<\/p>\n\n\n\n<p>Copy the default FIlebeat systemd service unit renaming it accordingly.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cp \/lib\/systemd\/system\/filebeat.service \/etc\/systemd\/system\/filebeat-elasticsearch.service<\/pre>\n\n\n\n<p>Edit the configuration file for the custom service unit and set the appropriate directories<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">vim \/etc\/systemd\/system\/filebeat-elasticsearch.service<\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>[Unit]\nDescription=Filebeat sends log files to directly to Elasticsearch.\nDocumentation=https:\/\/www.elastic.co\/products\/beats\/filebeat\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\n\nEnvironment=\"BEAT_LOG_OPTS=\"\nEnvironment=\"BEAT_CONFIG_OPTS=-c <strong>\/etc\/filebeat-elasticsearch\/filebeat.yml<\/strong>\"\nEnvironment=\"BEAT_PATH_OPTS=--path.home \/usr\/share\/filebeat --path.config <strong>\/etc\/filebeat-elasticsearch<\/strong> --path.data <strong>\/var\/lib\/filebeat-elasticsearch<\/strong> --path.logs <strong>\/var\/log\/filebeat-elasticsearch<\/strong>\"\nExecStart=\/usr\/share\/filebeat\/bin\/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS\nRestart=always\n\n[Install]\nWantedBy=multi-user.target\n<\/code><\/pre>\n\n\n\n<p>Similarly, for sending to Logstash;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cp \/lib\/systemd\/system\/filebeat.service \/etc\/systemd\/system\/filebeat-logstash.service<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">vim \/etc\/systemd\/system\/filebeat-logstash.service<\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>[Unit]\nDescription=Filebeat sends log files to Logstash.\nDocumentation=https:\/\/www.elastic.co\/products\/beats\/filebeat\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\n\nEnvironment=\"BEAT_LOG_OPTS=\"\nEnvironment=\"BEAT_CONFIG_OPTS=-c \/etc\/filebeat-logstash\/filebeat.yml\"\nEnvironment=\"BEAT_PATH_OPTS=--path.home \/usr\/share\/filebeat --path.config \/etc\/filebeat-logstash --path.data \/var\/lib\/filebeat-logstash --path.logs \/var\/log\/filebeat-logstash\"\nExecStart=\/usr\/share\/filebeat\/bin\/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS\nRestart=always\n\n[Install]\nWantedBy=multi-user.target\n<\/code><\/pre>\n\n\n\n<p>Reload Systemd configurations;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">systemctl daemon-reload<\/pre>\n\n\n\n<p>Start the two services;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">systemctl start filebeat-logstash filebeat-elasticsearch<\/pre>\n\n\n\n<p>Check the status;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">systemctl status filebeat-logstash filebeat-elasticsearch<\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\u25cf filebeat-logstash.service - Filebeat sends log files to Logstash.\n     Loaded: loaded (\/etc\/systemd\/system\/filebeat-logstash.service; disabled; vendor preset: enabled)\n     Active: active (running) since Wed 2020-11-25 19:29:20 UTC; 1min 21s ago\n       Docs: https:\/\/www.elastic.co\/products\/beats\/filebeat\n   Main PID: 129521 (filebeat)\n      Tasks: 9 (limit: 7031)\n     Memory: 28.4M\n     CGroup: \/system.slice\/filebeat-logstash.service\n             \u2514\u2500129521 \/usr\/share\/filebeat\/bin\/filebeat --environment systemd -c \/etc\/filebeat-logstash\/filebeat.yml --path.home \/usr\/share\/filebeat --path.config \/etc\/file&gt;\n...\n\u25cf filebeat-elasticsearch.service - Filebeat sends log files to directly to Elasticsearch.\n     Loaded: loaded (\/etc\/systemd\/system\/filebeat-elasticsearch.service; disabled; vendor preset: enabled)\n     Active: active (running) since Wed 2020-11-25 19:29:20 UTC; 1min 21s ago\n       Docs: https:\/\/www.elastic.co\/products\/beats\/filebeat\n   Main PID: 129540 (filebeat)\n      Tasks: 9 (limit: 7031)\n     Memory: 23.9M\n     CGroup: \/system.slice\/filebeat-elasticsearch.service\n             \u2514\u2500129540 \/usr\/share\/filebeat\/bin\/filebeat --environment systemd -c \/etc\/filebeat-elasticsearch\/filebeat.yml --path.home \/usr\/share\/filebeat --path.config \/et...\n<\/code><\/pre>\n\n\n\n<p>And there you go. That is all it takes to run multiple Filebeat instances in Linux.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"reference\">Reference<\/h3>\n\n\n\n<p><a aria-label=\"Install and configure multiple filebeat in linux instance (opens in a new tab)\" href=\"https:\/\/discuss.elastic.co\/t\/how-to-install-and-configure-multiple-filebeat-in-linux-instance\/130466\/4\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install and configure multiple filebeat in linux instance<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"related-tutorials\">Related Tutorials<\/h3>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/setup-kibana-elasticsearch-and-fluentd-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Setup Kibana Elasticsearch and Fluentd on CentOS 8<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/setup-multi-node-elasticsearch-7-x-cluster-on-fedora-30-fedora-29-centos-7\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Setup Multi-node Elasticsearch 7.x Cluster on Fedora 30\/Fedora 29\/CentOS 7<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-elasticsearch-7-on-fedora-30\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install Elasticsearch 7 on Fedora 30<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-elasticsearch-7-x-on-ubuntu-18-04-debian-9-8\/\" target=\"_blank\" aria-label=\" (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install Elasticsearch 7.x on Ubuntu 18.04\/Debian 9.8<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to run multiple filebeat instances in Linux system. Filebeat is one of the Elastic beat and is a<\/p>\n","protected":false},"author":3,"featured_media":11333,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[910,121,72],"tags":[922,2891,1107,2893,2892],"class_list":["post-7276","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-elastic-stack","category-howtos","category-monitoring","tag-filebeat","tag-install-filebeat-in-linux","tag-linux","tag-more-than-one-filebeat-services-in-one-systemd","tag-run-multiple-filebeat-instances-linux","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7276"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=7276"}],"version-history":[{"count":6,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7276\/revisions"}],"predecessor-version":[{"id":21534,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7276\/revisions\/21534"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/11333"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=7276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=7276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=7276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}