A single global Filebeat.yml file with multiple application based .yml file

Elastic Stack Beats
1

Hi All,
I have a requirement and trying to understand how to accomplish the same.

I am using filebeat 5.5.0 and sending multiple application logs to logstash and Kibana for visualaliation

Created a global yml file with below configuration
filebeat:
config_dir: /app01/ELK/filebeat-Directory

name: PB-Wss103
tags: ["PB-Wss103"]

Above config_dir has yml files of 10 application servers with unique log location, name & tags etc.

I now start filebeat using the global yml file. It works in sending all 10 application logs to logstash as output. Able to see logs in Kibana too. This is fine

However, my requirement is:
How do i specify from which application a specific log is being sent from?

Because i see all 10 application captures name and tags as given in the global file but i need to learn if there is any way to set up a field which will show me from which application the log if coming from.

Any help would be helpful!

2

You can specify fields for each prospector. So if you define one prospector per application, I think you get what you need.

1 Like
3

Thank you @ruflin. I added fields to each application log's YAML file and now able to see what i need.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.