Filebeat custom module

Not finding the doc of modules sufficient to make me a custom module.

Would it be possible to convert a filebeat.inputs section to a filebeat.config.modules configuration?

Eg. having working filestream like this:

- type: filestream
  id: camel-integration
  enabled: true
  pipeline: pjp-camel-integration
  paths:
    - /local/*/camel/jboss/standalone/log/*/*.log
  prospector.scanner.exclude_files: ['.*control-dashboard.+']
  tags:
    - camel
    - integration-log
  parsers:
    - multiline:
        type: pattern
        # Example: [2022-03-21 21:11:05,462] ...
        pattern: '^\[[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2},[[:digit:]]{3}\]'
        negate: true
        match: after
        max_lines: 5000

would like to moved this to a module configuration for easier enable/disable by deployment scripts, eg.:

- module: camel-server
  type: filestream
  id: camel-integration
  enabled: true
  pipeline: pjp-camel-integration
  paths:
    - /local/*/camel/jboss/standalone/log/*/*.log
  prospector.scanner.exclude_files: ['.*control-dashboard.+']
  tags:
    - camel
    - integration-log
  parsers:
    - multiline:
        type: pattern
        # Example: [2022-03-21 21:11:05,462] ...
        pattern: '^\[[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2},[[:digit:]]{3}\]'
        negate: true
        match: after
        max_lines: 5000

filebeat test config says okay , but it fails to create a runner/crawler:

{"log.level":"error","@timestamp":"2023-03-13T00:35:19.578+0100","log.origin":{"file.name":"instance/beat.go","file.line":1071},"message":"Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: error unpacking module config :error creating config from fileset camel-server/pipeline: type 'string' is not supported on top level of config, only dictionary or list","service.name":"filebeat","ecs.version":"1.6.0"}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.