# How to write filebeat prospectors with different layers for folders

**URL:** <https://discuss.elastic.co/t/how-to-write-filebeat-prospectors-with-different-layers-for-folders/116756>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 23, 2018, 9:40pm UTC](https://discuss.elastic.co/t/how-to-write-filebeat-prospectors-with-different-layers-for-folders/116756 "2018-01-23T21:40:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robert\_Chen](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@Robert\_Chen](https://discuss.elastic.co/u/Robert_Chen)\
**Post date:** [January 23, 2018, 9:40pm UTC](https://discuss.elastic.co/t/how-to-write-filebeat-prospectors-with-different-layers-for-folders/116756/1 "2018-01-23T21:40:26Z")

</div>

my logs folder is as this:

/logs/tomcat/\*.log  
/logs/job1/a1/a.log  
/logs/job1/a2/a2.log  
...  
/logs/job2/b.log  
/logs/jobn/jobn.log

I want one prospector for tomcat, then another prospector for jobs logs which should not include tomcat logs. (Jobs logs could have two different folder structures as above)  
What is the best way for this?

---

<div class="post-metadata">

**Author:** ![Robert\_Chen](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@Robert\_Chen](https://discuss.elastic.co/u/Robert_Chen)\
**Post date:** [January 23, 2018, 9:52pm UTC](https://discuss.elastic.co/t/how-to-write-filebeat-prospectors-with-different-layers-for-folders/116756/2 "2018-01-23T21:52:06Z")

</div>

one prospector for tomcat:  
/logs/tomcat/\*.log

one prospector for jobs:

> ```
> /logs/*/*.log
> /logs/*/*/*.log
> 
> ```

But the second will include tomcat, how to exclude tomcat logs?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 25, 2018, 5:38pm UTC](https://discuss.elastic.co/t/how-to-write-filebeat-prospectors-with-different-layers-for-folders/116756/3 "2018-01-25T17:38:27Z")

</div>

```auto
filebeat.prospectors:
- paths:
  - /logs/tomcat/*.log
  fields_under_root: true
  fields:
    type: tomcat
- paths:
  - /logs/job*/**/*.log
  fields_under_root: true
  fields:
    type: job

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2018, 5:39pm UTC](https://discuss.elastic.co/t/how-to-write-filebeat-prospectors-with-different-layers-for-folders/116756/4 "2018-02-22T17:39:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.