I have setup my ELK stack (5.3.2) to gather Exchange Message Tracking logs from my Exchange Cluster with a conf file in
D:\ELK\logstash-5.3.2\01-inputs.conf\exchange_msg_trk.conf and this is working well.
I have been tasked with monitoring Windows logons and have used https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat as a guide. I have a conf file in the same location called
winlogbeat_logons.conf. This is working as well...except I have to start logstash manually (using
bin/logstash -f D:\ELK\logstash-5.3.2\01-inputs.conf\winlogbeat_logons.conf) for it to accept the data. I am using NSSM to manage the logstash service.
Is it possible to have the logstash service start using muliple conf files i.e.
-f D:\ELK\logstash-5.3.2\01-inputs.conf\exchange_msg_trk.conf, D:\ELK\logstash-5.3.2\01-inputs.conf\winlogbeat_logons.conf?