Hi! let's say I need to send logs from a few directories to elasticsearch, like this: /var/log/logfolder1/server.log /var/log/logfolder2/server.log /var/log/logfolder3/server.log /var/log/logfolder4/server.log what about my filebeat.yaml? should it look like: - type: filestream id: id1 …

Filebeat includes the log path and name in each event by default. IDs are fine too! "log": { "file": { "path": "/var/log/jamf.log" }, "offset": 11171602 },

Discuss the Elastic Stack

Configure multiple logs location on filebeat

Elastic Stack Beats

warkolm (Mark Walkom) January 11, 2023, 9:52pm 3

Do you need to have a specific id for each of them?

Topic		Replies	Views
Analyse the log files Logstash	6	696	December 20, 2016
Create different Indices for different filebeat folder location Logstash	3	1236	June 18, 2018
Multiple Paths for different Indexes Beats filebeat	7	8208	July 5, 2017
Filebeat to logstash multiple indexs Logstash	22	9161	January 3, 2017
Filebeats and multiple files Beats filebeat	5	4716	August 26, 2016

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Configure multiple logs location on filebeat

Related topics