I have created a new beats module (jde) which contain a couple of filesets. I have gone through the testing phases of the filebeat modules and all tests pass - Yeah!
I am now trying to move this into production. To do this, I have copied my module onto a production server in the modules folder. I have created a /etc/filebeat/modules.d/jde.yml which contains
# Module: jde # Docs: https://www.elastic.co/guide/en/beats/filebeat/7.10/filebeat-module-nginx.html - module: jde # Access logs kernel: enabled: true # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. var.paths: - /home/kelvins/Oracle/Middleware/user_projects/domains/E1_Appsservers/PP129_J2EE_SI_BSSVlogs/jde*.log bssi_in: enabled: true var.paths: - /home/kelvins/Oracle/Middleware/user_projects/domains/E1_Appsservers/PP129_J2EE_SI_BSSVlogs/*_BSSV.log* input: multiline.pattern: '^###' multiline.negate: true multiline.match: after
This module contains a number customized field mappings. I can see this reflected in the fields.yml file on my dev machine. I have copied this file (which contains the jde definitions) onto my prod machine on /etc/filebeat/fields.yml.
I then run
filebeat setup and am expecting that the filebeat index will be updated - it isn't. So I delete the filebeat index and try again. It creates the filebeat index, but does not contain the jde definitions.
What am I doing wrong? What is the best way to moving a module from Dev into Production and therefore the upkeep of the module as filebeat agent gets updated? I gather and update will overwrite filebeat.yml in /etc/filebeat folder therefore removing my custom definitions.
I think I have look around for the answers, but cannot seem to find them.