Configure Input Logstash more one path

[marcos.vbp (Marcos Vinicius Bicca Pereira)]

Hello,

I have 10 managedServer Weblogic , and I would like add , application_log , access.log and etc , logs for the Logstash.
But I have one problem, how to make this , i try create file access.log using :

input {
file {
path => "/var/log/weblogic/producao/lms01/access.log"
type => "weblogic-access-lms01"

}
file {
path => "/var/log/weblogic/producao/lms02/access.log"
type => "weblogic-access-lms02"
}

}

But in Kibana, only show last log.
how to in the same grafic show both access.log diferents servers ?

Tks.

[magnusbaeck (Magnus Bäck)]

Since you haven't set start_position Logstash is tailing the newly added logfile. Is new data being appended to the file? You can increase Logstash's loglevel to get clues about what it's doing.

[marcos.vbp (Marcos Vinicius Bicca Pereira)]

Exactly as I'm testing and discovering SW.
I did the Weblogic managedServer 2 access.log mapping.
One of lms01 and another of lms02.

I created the filter to add the type field to be able to filter
filter {
if [type] == "weblogic-access-lms01" {
grok {
match => {"message" => "% {IPORHOST: clientip}% {GREEDYDATA: syslog_message}"}
add_field => {"server_log" => "% {type}"}
}
}
if [type] == "weblogic-access-lms02" {
grok {
match => {"message" => "% {IPORHOST: clientip}% {GREEDYDATA: syslog_message}"}
add_field => {"server_log" => "% {type}"}
}

}
gives you {
match => ["timestamp", "dd / MMM / yyyy: HH: mm: ss Z"]
}
}

But when I go to Kibana, I can only visualize the addition of the last lms02. If you change the order and put the lms01 last is only it that appears.

Both logs are being populated.

I want to show in kibana, in graphical the number of accesses of each server. lms01 and lms02.