Multiple IIS applications logs configurations (multiple filebeat.prospectors)

[ancross (Andi Kowik)]

Hi.
I'm trying to configure filebeat for IIS logs for multiple IIS application.
IIS logs are stored in separate folders for each app.

My main goal to achieve, is to have separate set of tags fields for each application logs

So I added two prospectors configuration like that:

filebeat.prospectors:

- input_type: log
 
  paths:
    - c:\inetpub\logs\LogFiles\W3SVC2\*.log
   document_type: iis_log
 
   tags: ["firstAPP", "serverName"]

fields:
  env: production
  
- input_type: log

  
  paths:
    - c:\inetpub\logs\LogFiles\W3SVC3\*.log
  document_type: iis_log
   
tags: ["secondAPP", "serverName", "API"]

fields:
  env: production

Unfortunately something is wrong with this configuration, because filebeat won't start.

When I use configuration for only one log path, everything works fine.

According to this example: https://www.elastic.co/guide/en/beats/filebeat/current/multiple-prospectors.html, configuration of multiple filebeat.prospectors is possible. But I'm not sure if I can add multiple tags.

[steffens (Steffen Siering)]

the configuration file is based on yaml, which is sensitive to indentation. Use spaces, no tabs and cleanup indentation so lists and dictionaries do align properly. See [1].