Adding multiple input files

Elastic Stack Beats
,
1

Hello,
Is it possible to add two inputs files in filebeat.yml?
Example:-

    - /etc/filebeat/inputs.d/*.yml
    - /etc/filebeat-oss/inputs.d/*.yml

I wanna add these two files in filebeat.yml under filebeat.config.inputs.

2

We allow only one glob pattern in filebeat.config.inputs.path. However, the pattern can match multiple directories. Have you tried setting the option to /etc/filebeat*/inputs.d/*.yml?

3

U can only use 1 glob? The documentation for filestream input says a list of glob based paths, filestream input | Filebeat Reference [7.17] | Elastic. I feel like that's misleading.

4

This is different, the inputs supports a list of glob, the config that point to a directory with other configuration files does not.

The config path for inputs is used when you want to load the inputs from external files, I used in that way on a previous company.

The documentation is here.

5

:man_facepalming::man_facepalming: completely misread that

6

I have added like this, It's working.

filebeat.config.inputs:
  enabled: true
  path: /etc/filebeat/inputs.d/*.yml
  reload.enabled: true
  reload.period: 10s
filebeat.inputs:
- type: log
  paths:
    - /path/log/*.log

but the issue is in *.yml have JSON log and input for *.log format, In the message, I'm getting timestamp as message, Is there any way I can drop the timestamp string from the message.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.