[FIlebeat] How to get logs default paths for modules?

Travis · October 20, 2020, 8:37am

Hello !

I'm using Filebeat (7.8) and module system.

For the var.paths of the syslog fileset, documentation says : "If this setting is left empty, Filebeat will choose log paths based on your operating system."

How can I get a list of these log path based on my operating system ? I would like to be sure that all required logs are well collected

Thanks for your help !

Mario_Castro · October 20, 2020, 9:01am

Such list do not exist, sorry. If you know the logs you want to parse, just set them in var.paths. It's the best way to get all logs you require.

Travis · October 20, 2020, 9:48am

Thanks for your response @Mario_Castro

OK. Any way to get that list maybe by a debug function ?

Travis · October 27, 2020, 1:53pm

Found !

github.com

elastic/beats/blob/master/filebeat/module/system/auth/manifest.yml#L5


module_version: 1.0

var:
  - name: paths
    default:
      - /var/log/auth.log*
      - /var/log/secure*
    os.darwin:
      # this works in OS X < 10.8. Newer darwin versions don't write
      # ssh logs to files
      - /var/log/secure.log*
    os.windows: []

ingest_pipeline: ingest/pipeline.yml
input: config/auth.yml

github.com

elastic/beats/blob/master/filebeat/module/system/syslog/manifest.yml#L5


module_version: "1.0"

var:
  - name: paths
    default:
      - /var/log/messages*
      - /var/log/syslog*
    os.darwin:
      - /var/log/system.log*
    os.windows: []

ingest_pipeline: ingest/pipeline.yml
input: config/syslog.yml

@Mario_Castro

system · November 24, 2020, 3:53pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.