Default and Customer Input and Filter Config in diffrent Files on diffrent Servers and System

Elastic Stack Logstash
1

Hello,

I think I've just not found the right approach, but I am stuck here's my question:

I wonder how I get it, that applies a default input and filter config all scanned files. It nevertheless is possible Custom configs apply.

Example:

For all the logs I need the following:

input {
  file {
    type => "generic"
    codec => multiline {
      pattern => "^% {} TIMESTAMP_ISO8601"
      charset => "ISO-8859-1"
      negate => true
      what => "previous"
      multiline_tag => "multiline"
    }

For LogFiles from dir A

tags => [ 'logfiles-application-A "]
path => [ "/opt/application-A/log/a/*.log"]

for LogFiles from dir B

tags => [ 'logfiles-application-B "]
path => [ "/opt/application-B/log/b/*.log"]

Tags and paths coming from the developers and are in another file

00_default_input.conf (Managed by SysAdmin and include codec)
10_application_a.conf (Input Tags and Path / filter for Application A) rolled out by Dev
10_application_b.conf (Input Tags and Path / filter for Application B) rolled out by Dev
20_output.conf (managed from sysadmin)

I hope I can express myself naturally, if something is not understood like ask.

2 
  pattern => "^% {} TIMESTAMP_ISO8601"

I think you mean:

  pattern => "^%{TIMESTAMP_ISO8601}"

If I understand your question correctly, wrap the filters in 10_application_X.conf in a conditional:

filter {
  if 'logfiles-application-A' in [tags] {
    # existing filters here
  }
}