Installing second filebeat

[SliuzasLukas]

Hi,

I'm in the process of figuring out how to add a second filebeat container. Despite reviewing the documentation, I haven't come across any instructions related to this, or I might have overlooked them.

I understand that I can generate a container using a Docker image, but once I've completed this step, the container doesn't seem to respond to commands like so-stop or so-start.

After manually creating a Docker container and making edits to the /opt/so/conf/so-status/so-status.conf file, it does show up in the so-status list.

[dougburks]

Instead of running a second instance of filebeat, could you simply modify the configuration for the existing filebeat?
https://docs.securityonion.net/en/2.3/filebeat.html#configuration

[SliuzasLukas]

Instead of running a second instance of filebeat, could you simply modify the configuration for the existing filebeat? https://docs.securityonion.net/en/2.3/filebeat.html#configuration

Hi,

The goal would be to run two filebeats and have them output to different logstash'es services

[dougburks]

Instead of running two instances of Filebeat, most folks would run a standalone or distributed deployment where Filebeat is already configured by default to send to Logstash and then configure Logstash with additional outputs:
https://docs.securityonion.net/en/2.3/logstash.html#forwarding-events-to-an-external-destination