I've two system one ELK for monitoring (Monitoring) and an ELK for auditing (Auditing)
On a machine, i've setup filebeat to send the output to Monitoring. that's fine.
Now,I 've to setup a filebaeat conf that for a specific file (called audit.log) the data are sent to the Auditing ELK, specifically to logstash, and not to the Monitoring.
So, in the end i've that all filebeat data are sent to Monitoring execpt audit.log that is sent to Auditing.
Is there a way to configure a module to read a file and send it to a specific output?
or what should be the approach for me?