Filebeat multiple input log files with condition

Elastic Stack Beats
1

Hi, I have 2 input files. access and error nginx log files. in one of them I need just specific lines.
I thought this might work but it doesn't.

paths:
- /var/log/nginx/myapp-access.log
fields: {log_type: myapp-media}
path:
- /var/log/nginx/myapp-error.log
fields: {log_type: myapp-media-error}
include_lines: ['dl-apk']

The include_lines: ['dl-apk'] seems to apply for both of input files, not only for the second one.
How should I config this ?
Thanx

2

Most likely your configuration file is not correct. Take a look at different example of multi-input setup: Multiple Filebeat inputs with logstash output

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.