I am shipping the logs from apache to elastic search through logstash as I need to ship to different elastic search cluster. My question is if i use the apache module in the filebeat modules, do i need to ship the logs separately ? below is my filebeat yaml. I think i am shipping the logs twice. please confirm
filebeat.inputs:
- type: log
paths:
- /apps/asf/logs/*/access.log.*
- /apps/logs/*/error.log.*
- /apps/logs/*/error_ssl.log.*
- /apps/logs/*/access_ssl.log.*
exclude_files: ['.gz$']
ignore_older: 24h
#============================= Filebeat modules ===============================
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
#==================== Elasticsearch template setting ==========================
setup.template.name: "filebeat"
setup.template.pattern: "filebeat-*"
setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression
#================================ Processors =====================================
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["172.18.18.65:5044","172.18.18.138:5044"]
loadbalance: true
#========================== Modules configuration =============================
filebeat.modules:
#-------------------------------- Apache Module --------------------------------
- module: apache
access:
enabled: true
var.paths: ["/apps/logs/*/access.log.*","/apps/logs/*/access_ssl.log.*"]
error:
enabled: true
var.paths: ["/apps/logs/*/error.log.*","/apps/logs/*/error_ssl.log.*"]