How to Consolidate filebeat.prospector properties

Elastic Stack Beats
1

Hello, below is a hypothetical prospector setup. Many parameters are unique to a given prospector but some are identical (for instance, the multiline params). Is there a way to configure the filebeat.yml to extract the shared params into some roll up location? Thanks for any response.

filebeat.propectors:

  • type: log
    paths:
  • /tmp/log/typeA*.log
    multiline.pattern: '[0-9]
    multiline.negate: true
    multiline.match: after
    ignore_older: 72h
    scan_frequency: 10s
    pipeline: "pipelineA"
    fields_under_root: true
    fields:
    logtype: TYPEA
  • type: log
    paths:
  • /tmp/log/typeB*.log
    multiline.pattern: '[0-9]
    multiline.negate: true
    multiline.match: after
    ignore_older: 72h
    scan_frequency: 10s
    pipeline: "pipelineB"
    fields_under_root: true
    fields:
    logtype: TYPEB
  • type: log
    paths:
  • /tmp/log/typeC*.log
    multiline.pattern: '[0-9]
    multiline.negate: true
    multiline.match: after
    ignore_older: 72h
    scan_frequency: 10s
    pipeline: "pipelineC"
    fields_under_root: true
    fields:
    logtype: TYPEC
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.