Multiple input log, reading the same files

Elastic Stack Beats
1

Hi, it is posible to use multiple inputs on the same files, but with different filters?

The configuration below works but only if I run filebeat with: ./filebeat.exe -c filebeat.yml not when I run it as a service

UPDATE: if I delete one of the inputs, whichever, it works as a service, it seem that only can be two inputs to the same file? 

filebeat.inputs:

- type: log
  enabled: true
  paths:
    - E:\logs\log-20??_??_??.log
  exclude_lines: ['.*disabled.*','.*error.*','.*warning*.','.*Error.*']
  include_lines: ['.*_FS_ALL.*']  
  fields:
    categoria: discos
  fields_under_root: true
  ignore_older: 1h
- type: log
  enabled: true
  paths:
    - E:\logs\log-20??_??_??.log
  fields:
    categoria: metricas
  fields_under_root: true    
  exclude_lines: ['.*disabled.*','.*error.*','.*warning*.','.*Error.*']
  include_lines: ['.*_CPU','.*_Memoria','.*_Uptime','.*_Ping']
  ignore_older: 1h

- type: log
  enabled: true
  paths:
    - E:\logs\log-20??_??_??.log
  fields:
    categoria: sap
  fields_under_root: true    
  exclude_lines: ['.*disabled.*','.*error.*','.*warning*.','.*Error.*']
  include_lines: ['.*SAP .*']
  ignore_older: 1h

output.logstash:
  hosts: ["xxx:5044"]
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.