Hi,
I use filebeat to read logs from different paths so for example
filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- D:\elastic_stack\LOGS\test-LOGS1\*
fields:
kafka_topic: "kafka-topic-test1"
multiline.type: pattern
multiline.pattern: '^\d{4}-\d{2}:\d{2}:\d{2}:\d{3}'
multiline.negate: true
multiline.match: after
multiline.max_lines: 19
- type: log
enabled: true
paths:
- D:\elastic_stack\LOGS\test-LOG2\*
fields:
kafka_topic: "kafka-topic-test2"
multiline.type: pattern
multiline.pattern: '^\d{2}/\d{2}/\d{4}\s\d{2}:\d{2}:\d{2}\s\d{3}-\sSTART\sCONNECTION.'
multiline.negate: true
multiline.match: after
multiline.max_lines: 120
I would like to know if there is somthing like condition in paths i mean for example if D:\elastic_stack\LOGS\test-LOGS1\LOG1.txt contains \d{4}-\d{2}:\d{2}:\d{2}:\d{3}| keep it and do the multiline and ..... else make this LOG1.txt under another path for example move it to D:\elastic_stack\LOG1.txt
Any help would be sincerely appreciate!
Thanks.