In my /etc/filebeat/filebeat.yml I have this set:
paths:
- /var/log/audit/audit.log
- /var/log/secure
But in our Kibana we only seem to be receiving from this log.file.path :
/var/log/messages
Not sure why
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.