Custom Logs integration with variable file path?

Elastic Stack Elastic Agent
1

I'm using a Fleet Agent with Custom Logs integration, but the path to the log file is dynamic and dependent on the name of the agent host -- so I have "C:\logs\${host.hostname}\elastic*.log" as the log file path. However, when I try to use a variable in the path like this, it fails to initialize it. Is this the correct format for including a variable in the path? It works perfectly when I use a static path like "C:\logs\my_host_name\elastic*.log".

With the ${host.hostname} variable in use, I only see in the filebeat logs are the default log files being configured, but no errors about my custom path.

[elastic_agent.filebeat][info] Configured paths: [C:\var\log\auth.log* C:\var\log\secure*]
[elastic_agent.filebeat][info] Configured paths: [C:\var\log\messages* C:\var\log\syslog* C:\var\log\system*]

Here's what my Custom Logs integration looks like:

image
image770×765 50.4 KB

This is on Elastic v8.13.2. Thanks!

2

Hi,

probably the Elastic Agent does not support the use of variables like ${host.hostname} in the file paths for the Custom Logs integration.

If all your logs are in subdirectories of C:\logs\ , you could use a path like C:\logs\*\elastic*.log to collect all matching log files from all subdirectories.

Regards