Is it possible to define the shared properties between different filebeat inputs just once?

Elastic Stack Beats
1

I have a filebeat.yml file, in which I want to define multiple filebeat inputs. I understand each input needs to be configured separately, but that would be sub-optimal in my opinion, since I could re-use a lot of properties that are shared across multiple inputs.

As an example, looking at this link, they have 2 inputs: https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-options.html

My use case is, I need to define the multiline pattern settings, which happen to be the exact same between all my filebeat inputs. Ideally I do not want to repeat the same thing over and over again.

Looking at documentation, I couldn't find my answer, but hopefully I am wrong. It would be a lot of config duplication if this is not supported.

2

I don't know how standard yaml is the beats config parser, but I would expect yaml anchors to work.

Can you try them?

3

Yup, thank you very much for the help. YAML anchors worked perfectly and picked up by beats config parser. Can even do nesting.

Example:

default_filebeat_yml_config: &default_filebeat_configs
  filebeat.config.modules:
    path: "${path.config}/modules.d/*.yml"

default_filebeat_input_configs: &default_input_configs
  multiline.pattern: "<MY-PATTERN>"
  multiline.negate: false

And finally use them:

  filebeat.yml:
    filebeat.inputs:
    - type: log
      fields:
        application: <my-app>
      paths:
      - "<MY-LOGS>"
      <<: *default_input_configs
    <<: *default_filebeat_configs
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.