I'm trying to configure filebeat for IIS logs for multiple IIS application.
IIS logs are stored in separate folders for each app.
My main goal to achieve, is to have separate set of tags fields for each application logs
So I added two prospectors configuration like that:
filebeat.prospectors: - input_type: log paths: - c:\inetpub\logs\LogFiles\W3SVC2\*.log document_type: iis_log tags: ["firstAPP", "serverName"] fields: env: production - input_type: log paths: - c:\inetpub\logs\LogFiles\W3SVC3\*.log document_type: iis_log tags: ["secondAPP", "serverName", "API"] fields: env: production
Unfortunately something is wrong with this configuration, because filebeat won't start.
When I use configuration for only one log path, everything works fine.
According to this example: https://www.elastic.co/guide/en/beats/filebeat/current/multiple-prospectors.html, configuration of multiple filebeat.prospectors is possible. But I'm not sure if I can add multiple tags.