Can filebeat ingest a JSON-format file as a single document?

I'm guessing this is really simple or ... not so much: we have an application deployed on a number of hosts that has a configuration file in JSON. We'd like to ingest the file as a single document using filebeat, in order to allow access to the configuration data for the instance along with the logs and metrics.

I know this can be done with curl, but filebeat is installed and dealing with setting up a separate path into Elasticsearch for one document seems inefficient (btw, this is an Elastic Cloud deployment). If there was a way to tell filebeat to ignore the newlines, for example, it's otherwise valid JSON so I'd expect it would work. Technically, this is multiline input, so I could approach it that way but I wonder if I'm missing something... the file can change either by someone manually editing it or a new copy being moved in place from a repository, so there isn't any data loss issue caused by a partial copy being ingested. Any relatively "clean" way to do this?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.