Filebeat - send a full config file every time is modified?

Elastic Stack Beats
1

How can i configure filebeat prospector to send the full content of a config file every time is modified?

Per example i want to send the full /etc/httpd/conf/httpd.conf file as a document everytime it is modified, not just new lines entries and in one just document, not a document per line.

2

Filebeat is designed to read a file line-by-line. It's not designed to index an entire file each time. You'd be better off writing your own application to index whole files like this with one of the language clients. You may also want to look into parsing the file as a bunch of fields in a document rather than as a single field in a single document.

3

We had similar requests in the past mainly for binary files. One idea we had that this could be added as new prospector type but that will require quite a bit of work and refactoring in filebeat.

4

This topic was automatically closed after 21 days. New replies are no longer allowed.