Is it possible to define the shared properties between different filebeat inputs just once?

I have a filebeat.yml file, in which I want to define multiple filebeat inputs. I understand each input needs to be configured separately, but that would be sub-optimal in my opinion, since I could re-use a lot of properties that are shared across multiple inputs.

As an example, looking at this link, they have 2 inputs: https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-options.html

My use case is, I need to define the multiline pattern settings, which happen to be the exact same between all my filebeat inputs. Ideally I do not want to repeat the same thing over and over again.

Looking at documentation, I couldn't find my answer, but hopefully I am wrong. It would be a lot of config duplication if this is not supported.

I don't know how standard yaml is the beats config parser, but I would expect yaml anchors to work.

Can you try them?

Yup, thank you very much for the help. YAML anchors worked perfectly and picked up by beats config parser. Can even do nesting.

Example:

default_filebeat_yml_config: &default_filebeat_configs
  filebeat.config.modules:
    path: "${path.config}/modules.d/*.yml"

default_filebeat_input_configs: &default_input_configs
  multiline.pattern: "<MY-PATTERN>"
  multiline.negate: false

And finally use them:

  filebeat.yml:
    filebeat.inputs:
    - type: log
      fields:
        application: <my-app>
      paths:
      - "<MY-LOGS>"
      <<: *default_input_configs
    <<: *default_filebeat_configs

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.