Multiple log entries in filebeat each with its id and multiple processors

Elastic Stack Beats
1

I am trying to configure filebeat so that it obtains logs from a server which is running 3 applications, the most logical thing is that each one has its id as a reference, for this configure 3 entries with its specific path and its id in this way. If there is another simpler way I would like to know.

image
image824×412 9.82 KB

Another detail is that in the processors configuration I am declaring environment variables in this way:
I need to have the V_APP_NAME for each of the applications that will get the filebeat, V_CODE_ENV: DEV and V_CODE_REGION: TAM will stay that way for fixed, I just need V_APP_NAME to adapt to the log entry that is obtained depending on the application.

image
image899×337 6.78 KB

In the image it only works for me in a general way and I want it more specific, for each input the V_APP_NAME has to be different since the app is different.

2

Hi @erwin339

Processors can be defined not only for all defined inputs, but for each input specifically, so smth like:

- type: filestream
  id: ...
  path: ...
  processors:
    - add_fields: ...

should work.

1 Like
3

Yes, after testing, make 3 processors for each input and a general one. I thought I was being too repetitive and maybe there was an easier way to do the same thing.

filebeat.inputs:

- type: filestream
  id: tena-app1
  enabled: true
  paths:
    - C:\Users\60085367\Desktop\ElasticPrueba_8.4\multi-apps-logs\App1\*
  processors:
  - add_fields: 
      fields: 
        V_APP_NAME: Tena.Log.Tester1

- type: filestream
  id: techi-app2
  enabled: true
  paths:
    - C:\Users\60085367\Desktop\ElasticPrueba_8.4\multi-apps-logs\App2\*
  processors:
  - add_fields: 
      fields: 
        V_APP_NAME: Techi.Log.Tester2

- type: filestream
  id: serg-app3
  enabled: true
  paths:
    - C:\Users\60085367\Desktop\ElasticPrueba_8.4\multi-apps-logs\App3\*
  processors:
  - add_fields: 
      fields: 
        V_APP_NAME: Tam.Log.Tester3

  parsers:
    - multiline:
        type: pattern
        pattern: ^<log4j:event.*
        negate: true
        match: after
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:
  host: "tamca.tena.techi.net:5601"

output.logstash:
  hosts: ["0.0.0.0:5044"]

processors:
  - add_host_metadata:
      netinfo.enabled: true
  - add_fields: 
      fields:
        V_CODE_ENV: DEV
        V_CODE_REGION: TAM
        fields_under_root: true

Would this be a correct configuration?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.