How to write filebeat prospectors with different layers for folders

Elastic Stack Beats
1

my logs folder is as this:

/logs/tomcat/*.log
/logs/job1/a1/a.log
/logs/job1/a2/a2.log
...
/logs/job2/b.log
/logs/jobn/jobn.log

I want one prospector for tomcat, then another prospector for jobs logs which should not include tomcat logs. (Jobs logs could have two different folder structures as above)
What is the best way for this?

2

one prospector for tomcat:
/logs/tomcat/*.log

one prospector for jobs:

/logs/*/*.log
/logs/*/*/*.log

But the second will include tomcat, how to exclude tomcat logs?

3 
filebeat.prospectors:
- paths:
  - /logs/tomcat/*.log
  fields_under_root: true
  fields:
    type: tomcat
- paths:
  - /logs/job*/**/*.log
  fields_under_root: true
  fields:
    type: job
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.