How to make input processor process all data?

In my application, there are multiple logs that need to process, I want every log has its own processors.
BUT processors under specific input only process data collected by this input;

- type: log
    - ./data.log
  fields_under_root: true
    '@log_type': data
    namespace: data
    net_pub: 1
  json.keys_under_root: true
  json.overwrite_keys: true
  json.add_error_key: false
    - copy_fields:
          - from:
            to: srv_host
          - from: dur
            to: mydur-data
        fail_on_error: false
        ignore_missing: true
    - drop_fields:
        fields: ["agent","host","log","ecs"]

how to make it also process all data collected by Filebeat?

Not sure if I understand your problem. You define processors globally, so they can process all data (top-level processors):

yes, top-level processors can work. but in my scenario, every input must have its own processor list which totally diffent. so I cant use a top-level processor ;

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.