Different files to same index

Elastic Stack Beats
1

Hi,

I have this simply configuration on filebeat.inputs

filebeat.inputs:

  • type: log
    paths:
    • /var/log/test.log
    • /var/log/temp_tst/*.log

the beats are loaded on a single index . I'm not understanding why is considered ONLY the file 'test.log' under the first path . The files under the second path are not considered!!!
The file are the same but with different number of records.

The index was created but basing only on the file under the first path!

I'm really not able to understand which is the problem .... anyone can help me ?

Thanks

2

Look in filebeat logs, if you don't see messages for filebeat to attempt to harvest the 2nd dir, you may have the pattern incorrect.

If filebeat running as root?

3

Harvests see the paths, but process only the first one.
The second folder have chmod 777

4

paths:
- /var/log/test.log
- /var/log/temp_tst/*.log

should work

5

was a problem during the paste of conf file ... this is mine :

filebeat.inputs:
-type: log
paths:
-/var/log/test.log
-/var/log/temp_tst/*.log

6

You need to follow the YAML format.
below is my example

filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - L:\IISLogs\W3SVC*\*
    - M:\IISLogs\W3SVC*\*
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.