Configure Input and Modules at the same time for Filebeat

Elastic Stack Beats
1

Hi,

I have following scenario:

  1. One filebeat installation to collect icinga logs. For this I am using icinga module

  2. On the same host I have another application's logs, which are located in different path and have different multiline configuration

I do not want to spin up another filebeat to collect the logs from point 2, therefore I have a question:

Am I able to continue harvesting icinga logs using the module AND configure another input manually to harvest another application's log files with different multiline pattern.

Thank you

2

Hi @Kosodrom

Perhaps take a look at the live reload feature

3

Thanks for the response. I am sorry I do not understand how live reload feature enables me to use a module an a custom input (log for example) at the same time for one filebeat installation?

4

Apologies I miss-understood I thought you wanted to add additional logs / paths while filebeat was already running.

If you are simply saying you want to collect multiple types / source of logs on a server with filebeat, yes you absolutely can you just use as many modules you like plus and/ or you can define as many inputs as you like so the answer is yes.

This is very common
Multiple modules like system and ngnix

and or multiple inputs in the filebeat.yml file ... Or all of them together

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*

  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  #exclude_lines: ['^DBG']

...
- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /myother/typesof/logs/*.log

....

# filestream is an experimental input. It is going to replace log input in the future.
- type: filestream

  # Change to true to enable this input configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /mystreaming/log/*.log


  # Exclude lines. A list of regular expressions
1 Like
5

Thank you. This works perfectly. Somehow I thought that when you use modules, filebeat inputs will be ignored, which is wrong. Thank you

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.