Filebeat config - USER system env variable

[Johny]

Hello, i am trying read logs from currently logged user folder. In filebeat config i have:
paths:
- /home/${USERNAME}/logs/foo.log, this does not even compile. But it work when i hardcode name like this:
paths:
- /home/${USERNAME:foo}/logs/foo.log, but i need this path to be dynamically allocated.

There are no logs in /var/log/filebeat/filebeat.log

[Andre_Letterer (André Letterer)]

Hi Johny,

Welcome to the discuss forum.
Now if you give out the environment variables on a linux system:

env | grep USER | sort

I think you should find out that the variable should be USER. Variable USERNAME only exists on Windows systems as far as I know.

- /home/${USER}/logs/foo.log

Apart from that I would like to know what exactly you are trying to accomplish.
Do you want to u read dynamically through all your user folders?
Something like

/home/usera/logs/foo.log
/home/userb/logs/foo.log

and if you add a new user userc it should start to read this one /home/userc/logs/foo.log as well?

If this what you want to do?

Because with that at the moment I assume it will log only one folder.

[Johny]

Hello and thank you for your reply.
Use case is... When userA start using program. It will creates:
/var/log/program-userA/foo.log.
Then second user loggin to the machine and it will creates new logs in:
/var/log/app-userB/foo.log.
I need filebeat config that automatically assign variables of currently logged users to the path:
/var/log/app-{USER}/foo.log, so I don't have to manualy set up and hardcode users to each machine.
I can tail path like this /var/log/app- * /*.log. But it's not look like the best practice. Besides this logs everything.

To find user variable I used env command and when i use it in cd path/to/{variable}/folder, it works fine.

[Andre_Letterer (André Letterer)]

Hi Johny,

maybe it is

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#input-paths

Globbing depends on slashes like is documented here: https://golang.org/pkg/path/filepath/#Glob

If you want you maybe could disable recursive globbing:
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#recursive_glob

So basically it the actual best practice like that:

filebeat.inputs:
- type: log
  recursive_glob.enabled: false
  paths:
    - /var/log/program-*/foo.log

Now apart from that let my try to tackle your last comment
If I understand you correctly you maybe have following paths like e.g.:

/var/log/program-john/foo.log
/var/log/program-jessy/foo.log
/var/log/program-retrieve/foo.log

And what you want is automatically identify the first 2 paths as being paths from users john and Jessy and it should ingest these ones, but not the third one, which is not a user?

Is this exactly what you are trying to do?