Log viewing - ELK

Elastic Stack Beats
1

Hello there,

I have set up the following configuration in filebeat config file but it is not picking up the second input. not sure why

filebeat.inputs:

  • type: log
    enabled: true
    paths:
    • C:\ELK7.9.2\Logs*.log
  • type: log
    enabled: true
    paths:
    • C:\ELK7.9.2\LogsA*.log

Can anyone please tell me if I am making any mistake here?

Thanks,
Akhil

2

Hi!

I think that C:\ELK7.9.2\Logs*.log path will match C:\ELK7.9.2\LogsA*.log too. When you say that it is not picking up the second input what do you mean, you see anything special in Filebeat's logs? (run in debug mode for more information)

3

Hi Chris,

As per my understanding, following allows me to create one index pattern in Kibana and I am able to see whatever logs are there in Logs folder. so I created two inputs by giving two paths so I can create two index patterns for two different types of logs.

filebeat.inputs:

  • type: log
    enabled: true
    paths:
    • C:\ELK7.9.2\Logs*.log

and I can only create one index pattern in Kibana and it has all the data. I don't know how. I thought if I give two paths, I will be able to create two indexes.

I hope that's not confusing.

Thanks,
Akhil

4

I see.

Please check conditional output at Configure the Elasticsearch output | Filebeat Reference [7.12] | Elastic, it should be what you are looking for.

5

Thank you Chris. My issue is resolved.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.