Filebeat to stream .gz logs to ES/LS

Elastic Stack Beats
1

Hi,

So from doing some research on this topic I realized that the answer is always no, not yet.

However, when looking at the elastic website and checking the filebeat configs why would the example be about "excluding" .gz files when using the exclude_files setting when it doesn't even read them anyways ?

The only reason im asking is because based on that and as a reader i'm under the impression that Filebeat can read .gz files, when using a wild card in my log path like /var/log/my_app_logs/* or /var/log/my_app_logs/*.gz otherwise why would I exclude them ?

**Filebeat version used is 5.5 and 5.4

2

Theoretically Filebeat can ship can any file. They're just bytes on disk. And Filebeat will read any file, but it will treat the file as if it were plain ascii text (unless a different encoding is specified). And the output will be a bunch of UTF-8 encoded garbage.

For this reason it is necessary to exclude files that are not textual.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.