I am testing filebeat to see if it can read multiple files based on log_type
i can make decision as to which index the logs have to go in elasticsearch from logstash.
filebeat.prospectors:
- input_type: log
enabled: true
paths:
- C:\data\log\eis.log
fields: {log_type: eis}
- input_type: log
enabled: true
paths:
- C:\data\log\sa.log
fields: {log_type: sa}
multiline.match: after
multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after
output.file:
path: "c:/var"
filename: "filebeat.log"
The above configuration is reading only 1 file.