Filebeat CEL Input Type - FIle Options

Elastic Stack Elasticsearch
1

I'm using a CEL type input in Filebeat. Currently the filebeat.yml file points at a specific directory/file.

What is the syntax to wildcard a portion of the file? (i.e. for the parameter
resource.url: file:///home/directory/subdirectory1/subdirectory2/file.name

how can I specify
resource.url: file:///home/directory/*/subdirectory2/file.name

in the filebeat.yml file?

Marty Pacocha

2

Hi,

you can use wildcards in the paths to specify multiple files. However, the wildcard (*) can only be used to match files in a directory, not directories themselves.

if you want to match files in multiple directories, you will need to specify each directory separately. For example:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/directory/subdirectory1/subdirectory/*.log
    - /home/directory/subdirectory3/subdirectory/*.log

Regards

3

We are successfully using wildcards in directories in other Filebeat inputs. The difference between those instances and this one is that for the successful instance we use the keyword paths, but for CEL we need to use the keyword resource.

I'm trying to figure out is whether we can use wildcards for the resource keyword or not.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.