How to configure apache.yml in filebeat with multiple paths in var.paths

Elastic Stack Beats
1

i am not getting on how i can add multiple paths in var.paths parameter in apache.yml? i have configured one path but i have multiple log files with different names so how can add those paths too?

# ============================== Filebeat inputs ===============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*

apache.yml

# Module: apache
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.x/filebeat-module-apache.html

- module: apache
  # Access logs
  access:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ['/var/log/apache2/access.log*']

  # Error logs
  error:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ['/var/log/apache2/error.log*']

how i can configure apache.yml for multple paths of log files?

2

Hi @Shriram_Wasule,

Configuration files are in YAML format, you can define multiple paths as lists.

It is probably easier to see with some examples :slightly_smiling_face:

An example with an input:

filebeat.inputs:
- type: log
  paths:
    - /var/log/*.log
    - /var/log/someapp/*.log

That is equivalent to:

filebeat.inputs:
- type: log
  paths: ["/var/log/*.log", "/var/log/someapp/*.log"]

In the case of the module you can use similar formats:

- module: apache
  access:.
    var.paths:
      - '/var/log/apache2/access.log*'
      - '/var/log/apache2/vhost-*.log*'
  error:
    var.paths: ['/var/log/apache2/error.log*', '/var/log/apache2/vhost-error-*.log*']
3

Hi jsriano,
Thanks for the reply..Its really helpful.
I have one another doubt,
Can you please tell me difference in filebeat.input paths and modules path?

Shriram Wasule
Computer Engineer

9764324411 |
shriramwasule@gmail.com

https://wwwshriramwasulecom.000webhostapp.com/

4

Inputs and modules are two differenct concepts in Filebeat, inputs define how logs should be collected by filebeat, while modules cover different aspects of data collection for an specific service.
For example the Apache module uses the log input under the hood to collect Apache logs, and it also includes processors and ingest pipelines to parse these logs, and Kibana dashboards to visualize the parsed information.

If you want to collect logs from an Apache server, I would suggest to use the Apache module, then you wouldn't need to define any input under filebeat.inputs.
On the other hand, if you want to collect logs from a custom application, or a service that doesn't have a module, you could define your own inputs, processors and pipelines.

5

thanks for the reply, its quite good explanation..

1 Like
6

i have another question, currently i want to get two different logs in two different indices.
i have apache enable and tomcat access logs. this two i want store in two different indices how can i achieve this? i am not using logstash.

7

Why do you want to have different indexes for these logs? This is possible, but can increase the complexity of your deployment, and make it more problems-prone if not done with a lot of care.

Filebeat automatically configures the indexes it uses and this configuration uses to be enough for most of the cases. Using custom indexing strategies requires you to manage several things that otherwise would be automated.

As a side note, with Fleet/Agent (in beta), the default is to use different indexes for each integration, and this is automatically managed by Fleet. Perhaps you can give it a try to see if it better fits your needings.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.