Filebeat only sends the first log input

Elastic Stack Beats
1

Hello,

I got an filebeat.yml with an filebeat 7.8.0 instance on an server which should send some logs to a central logstash but it only sends the first log input and the others seemd to be ignored or anything else.
Can anyone explain that?

Here is the filebeat.yml:

#================================ General =====================================
logging.to_syslog: false

#============================= Filebeat custom logs ===============================

filebeat.inputs:
- type: log
  tags: ["opengate_syslog"]
  paths:
    - "/mnt/og_logs/*/log/syslog.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["opengate_traffic_incoming"]
  paths:
    - "/mnt/og_logs/*/log/traffic_incoming_*.log"
  exclude_files: ['\.gz$','\.bz2$']

- type: log
  tags: ["opengate_traffic_outgoing"]
  paths:
    - "/mnt/og_logs/*/log/traffic_outgoing_*.log"
  exclude_files: ['\.gz$','\.bz2$']

- type: log
  tags: ["backstage_syslog"]
  paths:
    - "/mnt/san/fast/st*/instances/*/log/syslog_*.log"
    - "/mnt/san/fast/webcache/instances/*/log/syslog_*.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["render_processhandler"]
  paths:
    - "/mnt/san/fast/st*/instances/*/processing/processhandler/log/processhandler_*render*.log"
    - "/mnt/san/fast/st*/instances/*/processing/processhandler/log/processhandler_*rdr*.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["ftp_in_mediamonitor"]
  paths:
    - "/mnt/san/fast/*/instances/*/processing/mediamonitor/log/mediamonitor_*ftp-in*.log"
  exclude_files: ['\.gz$', '\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["ftp_out_processhandler"]
  paths:
    - "/mnt/san/fast/st*/instances/*/processing/processhandler/log/processhandler_*ftp-out*.log*"
  exclude_files: ['\.gz$', '\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\"'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["api_accesslog"]
  paths:
    - "/mnt/san/fast/st*/instances/*/log/api_access_*.log"
    - "/mnt/san/fast/webcache/instances/*/log/api_access_*.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}\"'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["api_errorlog"]
  paths:
    - "/mnt/san/fast/st*/instances/*/log/api_error_*.log"
    - "/mnt/san/fast/webcache/instances/*/log/api_error_*.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}\"'
  multiline.negate: true
  multiline.match: after

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 1

#================================ Outputs =====================================

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ['pr-fe-log-elk-01-access.dc.muc.picturemaxx.net:5044', 'pr-fe-log-elk-01-access.dc.muc.picturemaxx.net:5045', 'pr-fe-log-elk-01-access.dc.muc.picturemaxx.net:5046', 'pr-fe-log-elk-01-access.dc.muc.picturemaxx.net:5047']
  loadbalance: true
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.