Elasticsearch output split problem

I have some custom grok in logstash conf.d directory. That grok split /home/local/example/example.log path data. I wish - /var/log/*.log path data will be split via filebeat system module and /home/local/example/example.log path data will be split via custom grok.

If I configue filebeat.yum like

hosts: [""]

/home/local/example/example.log path data split field:
"Class" => "c.n.s.s.SmsGatewayService:331"
"source" => "/home/local/example/example.log",
"@timestamp" => 2018-10-03T09:35:57.404Z,
"Thread" => "http-nio-8080-exec-6",
"host" => {
"name" => "vm1"

But I configure filebeat like

host: ""

hosts: [""]

/home/local/example/example.log path data will not be split:

I need to split module data and custom path data via output elasticsearch and kibana host.

Thanks for help me

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.