Multiple Filebeat Inputs Files

(Matthew Iverson) #1

I was wondering if it is possible to have a conf.d type folder for filebeat to create multiple input items. I know I can list them all in filebeat.yml but that isn't preferable. I also don't think it makes sense to use a module like syslog if they are application logs. If someone wants to correct me, feel free to

(Robert Cowart) #2

I don't know if this works before 6.4.x, but in the latest versions you can put the following in filebeat.yml:

    enabled: true
    path: inputs.d/*.yml
    reload.enabled: true
    reload.period: 10s

And then have multiple files under inputs.d like this:

  |- filebeat
       |- inputs.d
           |- log_mailoney.yml
           |- log_snort.yml
           |- log_suricata_eve.yml

The contents of the files in inputs.d can be as simple as this:

# Suricata EVE JSON Logs
- type: log
  enabled: true
    - /var/log/suricata/eve.json
    event.type: suricata_eve
  fields_under_root: true

(Matthew Iverson) #3

How did I miss this? Thanks, this solves my issue!

(DeDe Morton) #4

Just wanted to add that loading external config files has been supported for quite awhile (see the docs), but it looks like we never updated the docs to show path: inputs.d/*.yml instead of path: configs/*.yml. I'll update the docs so the config example matches what people expect. Thanks!

(Matthew Iverson) #5

Thanks a bunch!!

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.