# Filebeat multi-path configuration for send logs to Logstash

**URL:** <https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 18, 2021, 6:13am UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599 "2021-03-18T06:13:19Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nagavardhan25](https://avatars.discourse-cdn.com/v4/letter/n/97f17d/32.png) [@Nagavardhan25](https://discuss.elastic.co/u/Nagavardhan25)\
**Post date:** [March 18, 2021, 6:13am UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599/1 "2021-03-18T06:13:19Z")

</div>

## Hi, I have one config file in filebeat, i am trying to add two paths for reading the logs from two different locations and under feilds i have created two directories for storing the values in logstash side. Below is the config files.:

```
filebeat.inputs:
- type: log
   enabled: true
   paths:
       - "C:\\devops\\poms\\logs\\ *.log"
       - * "C:\\test\\logs1\\ *.log"
fields_under_root: true
fields:
dir1: application1
dir2: application2</em>

output.logstash:
    enabled: true
    hosts: ["localhost:5060"]

```

* * *

## **And logstash output is:**

```
output {
stdout { codec => rubydebug }
file {
codec => line { format => "%{message}"}
#path => ["C:\Temp\junk\logs\testdoc.log-%{+YYYY.MM.dd}"]
#path => ["C:\Temp\junk\logs%{[dir]}%{[fileName]}-%{+YYYY.MM.dd}" && "C:\Temp\junk\logs1%{[dir]}%{[fileName]}-%{+YYYY.MM.dd}"]
path => "C:\Temp\junk\logs%{[dir1]}%{[fileName]}-%{+YYYY.MM.dd}"
}
file {
codec => line { format => "{message}" }
path => "C:\Temp\junk\logs1%{[dir2]}%{[fileName]}-%{+YYYY.MM.dd}"
}

```

* * *

```
..

```

When i execute this, in both directories only this path files 'C:\test\logs1\ \*.log" 'are reading from filebeat side and writing output from logstash.  
Would like to know best solution for this.  
Thanks in Advance. 🙂

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [March 18, 2021, 8:52pm UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599/2 "2021-03-18T20:52:40Z")

</div>

Can you check if your Filebeat log has any messages about files matching `C:\devops\poms\logs\*.log`, particularly with the word `harvester` in them?

Shaunak

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [March 18, 2021, 8:53pm UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599/3 "2021-03-18T20:53:35Z")

</div>

> [@Nagavardhan25](#):
>
> ```auto
> paths:
> - "C:\\devops\\poms\\logs\\ *.log"
> - * "C:\\test\\logs1\\ *.log"
> 
> ```

Also, is this configuration correct?

Should there be a `*` after the `-` on the second line?

Should there be a space before the `*.log` on both lines?

Shaunak

---

<div class="post-metadata">

**Author:** ![Nagavardhan25](https://avatars.discourse-cdn.com/v4/letter/n/97f17d/32.png) [@Nagavardhan25](https://discuss.elastic.co/u/Nagavardhan25)\
**Post date:** [March 19, 2021, 7:04am UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599/4 "2021-03-19T07:04:59Z")

</div>

Hi Shaunak,  
Thanks for your response, yes i have removed "\*" in the second line.  
I have able see out directories, it only reads in this location ""C:\test\logs1\ \*.log"" files.

```
fields_under_root: true
fields:
dir1: application1
dir2: application2

```

As per above config, in output side, it is creating two directories but writing only one path files in both dir's like dir1 and dir2.  
My requirement is like 1st path files write in dir1 and 2nd path files write in dir2.

Hope this time you may get a clear idea of my requirement.

---

<div class="post-metadata">

**Author:** ![Nagavardhan25](https://avatars.discourse-cdn.com/v4/letter/n/97f17d/32.png) [@Nagavardhan25](https://discuss.elastic.co/u/Nagavardhan25)\
**Post date:** [March 22, 2021, 10:17am UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599/5 "2021-03-22T10:17:14Z")

</div>

Hi Friends,  
Can you please anyone help me with the above scenario?

---

<div class="post-metadata">

**Author:** ![Nagavardhan25](https://avatars.discourse-cdn.com/v4/letter/n/97f17d/32.png) [@Nagavardhan25](https://discuss.elastic.co/u/Nagavardhan25)\
**Post date:** [March 24, 2021, 9:44am UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599/6 "2021-03-24T09:44:44Z")

</div>

Hello Friends,  
Please respond to my question if anyone having idea about this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2021, 11:45am UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599/7 "2021-04-21T11:45:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.