Filebeats for configuration file

[ratseba (Seba)]

Hi,
I need send content of config file from some service to Elasticsearch. This file not change often (max ten times a year). This file have structure like:

version=77.1.2
ActiveModule=monitoring, tts, asr
LicenseNumber=98usddou2kosad9123

What i need:

1. Read this file once per day from begining and ship this to Elasticsearch.

I try do this with bellow configuration for filebeat, but i can't set clean_inactive without ignore_older.

- type: log
  enabled: true
  harvester_limit: 1
  close_eof: true
  clean_inactive: 1440m
  paths:
    - D:\ElasticSearch\Test\MyTestConfigFile.txt

How i can do this ? Maybe there is some dedicated module for config files ?

[legoguy1000 (Alex)]

I would use a windows scheduled task to run filebeat manually with the --once flag, Filebeat command reference | Filebeat Reference [7.16] | Elastic.

[ratseba (Seba)]

Hi Alex,
Thank you for response. I have several another things to do by filebeat on this machine. In way proposed by you i have to maintain two separate filebeat instance. i'd like to avoid it. Is there any other option ?

[legoguy1000 (Alex)]

Not that I'm tracking as this is a very unique use case. And u wouldn't necessarily need 2 instances of Filebeat. Just another config file that u can reference via -c <path to config> when called by the scheduled task.

[ratseba (Seba)]

Can I run Filebeat like a Windows service and the same .exe file run from TaskScheduler (at the same time)? I have one more idea: run powershell from taskScheduler and write the data from a configuration file to another file on one line (one event). Repeat this once a day. In this option, I do not need to configure aggregation on logstash.