Default prospector options - Filebeat 5.4.1

Elastic Stack Beats
1

Hello!

I have several filebeat (5.4.1) prospectors and I want to use the same options for most of them.
Is it possible to set the options as defaults for all prospectors and then overwrite them under prospector?
As an example, I currently have:

    filebeat.prospectors:
        -
          paths:
            - "/var/log/nginx/*access*log"
          exclude_files: ['.gz$', '.xz$']
          tail_files: true
          close_inactive: 1m
          close_removed: true
          ignore_older: 60m
          clean_inactive: 61m
          clean_removed: true
          scan_frequency: 10s
          input_type: log
          document_type: nginx_access
          tags: ["nginx", "access_log", "plain"]
        -
          paths:
            - "/var/log/nginx/*error*log"
          exclude_files: ['.gz$', '.xz$']
          tail_files: true
          close_inactive: 1m
          close_removed: true
          ignore_older: 60m
          clean_inactive: 61m
          clean_removed: true
          scan_frequency: 10s
          input_type: log
          document_type: nginx_error
          tags: ["nginx", "error_log", "plain"]

And I'd like to have:

filebeat.prospectors:
defaults:
exclude_files: ['.gz$', '.xz$']
tail_files: true
close_inactive: 1m
close_removed: true
ignore_older: 60m
clean_inactive: 61m
clean_removed: true
scan_frequency: 10s
input_type: log

 paths:
    - "/var/log/nginx/*access*log"
 exclude_files: ['.gz$', '.xz$']
 tail_files: false
 document_type: nginx_access
 tags: ["nginx", "access_log", "plain"]
  • paths:
    - "/var/log/nginx/errorlog"
    document_type: nginx_error
    scan_frequency: 5s
    tags: ["nginx", "error_log", "plain"]

As you can see in my original configuration I have to maintain the same options in all prospectors.
Is there anything similar you can do in filebeat configuration, or any workarounds, so I can have separate prospector config files with minimal options set per prospector?

2

Hi,

this is an interesting feature, although I'm not sure how many people would benefit from it.

You can open an enhancement request in our Github issues page: https://github.com/elastic/beats/issues, then we can track interest from other people.

3

I've opened an issue @ https://github.com/elastic/beats/issues/4489

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.