Filebeat processor add tags to log files from different folders

[Ryan_Downey]

Filebeat 7.4.0

I've been trying to work off of the link below to add tags to logs that are coming from different folders. We have multiple different log folders like vdi001, vdimgmt001 and flx001 and we'd like to use filebeat to tag the logs as their shipped. It seems like the _add_tags: when: conditional: format is the way to go but after that I'm not sure what the syntax is. I've been trying the log.file.path option like the other thread has but cant seem to get it to work.

Multiple processors with same name - add_tags

Hello, is it possible to create configuration with multiple processors, using same processor name, but different conditions? I`d like to add tags for specific log files, like all *.log files must be tagged as "log" but all *.out files, as "out", same time - access.log I would like to tagg as "access". Tried to add multiple processors in filebeat.yml: processors: - add_tags: when: contains: log.file.path: ".log" tags: ["log"] processors: - add_tags: when: contai…

processors:
  - add_tags:
      when:
        contains:
          log.file.path: "/logs/vdi001/vdi001.*.log"
      tags: ["vdi","esx"]