# Multiple log entries in filebeat each with its id and multiple processors

**URL:** <https://discuss.elastic.co/t/multiple-log-entries-in-filebeat-each-with-its-id-and-multiple-processors/314987>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 23, 2022, 3:52am UTC](https://discuss.elastic.co/t/multiple-log-entries-in-filebeat-each-with-its-id-and-multiple-processors/314987 "2022-09-23T03:52:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)\
**Post date:** [September 23, 2022, 3:52am UTC](https://discuss.elastic.co/t/multiple-log-entries-in-filebeat-each-with-its-id-and-multiple-processors/314987/1 "2022-09-23T03:52:02Z")

</div>

I am trying to configure filebeat so that it obtains logs from a server which is running 3 applications, the most logical thing is that each one has its id as a reference, for this configure 3 entries with its specific path and its id in this way. If there is another simpler way I would like to know.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21bfe1237c43999d5b7fd3e187aba06feae29eed.png)

Another detail is that in the processors configuration I am declaring environment variables in this way:  
I need to have the V\_APP\_NAME for each of the applications that will get the filebeat, V\_CODE\_ENV: DEV and V\_CODE\_REGION: TAM will stay that way for fixed, I just need V\_APP\_NAME to adapt to the log entry that is obtained depending on the application.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f90dafa8310329a42bbffba67c75864412501a5.png)

In the image it only works for me in a general way and I want it more specific, for each input the V\_APP\_NAME has to be different since the app is different.

---

<div class="post-metadata">

**Author:** ![Tetiana\_Kravchenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tetiana_kravchenko/32/102683_2.png) [@Tetiana\_Kravchenko](https://discuss.elastic.co/u/Tetiana_Kravchenko)\
**Post date:** [September 23, 2022, 4:01pm UTC](https://discuss.elastic.co/t/multiple-log-entries-in-filebeat-each-with-its-id-and-multiple-processors/314987/2 "2022-09-23T16:01:01Z")

</div>

Hi @erwin339

Processors can be defined not only for all defined inputs, but for each input specifically, so smth like:

```auto
- type: filestream
  id: ...
  path: ...
  processors:
    - add_fields: ...

```

should work.

---

<div class="post-metadata">

**Author:** ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)\
**Post date:** [September 23, 2022, 6:41pm UTC](https://discuss.elastic.co/t/multiple-log-entries-in-filebeat-each-with-its-id-and-multiple-processors/314987/3 "2022-09-23T18:41:42Z")

</div>

Yes, after testing, make 3 processors for each input and a general one. I thought I was being too repetitive and maybe there was an easier way to do the same thing.

```auto
filebeat.inputs:

- type: filestream
  id: tena-app1
  enabled: true
  paths:
    - C:\Users\60085367\Desktop\ElasticPrueba_8.4\multi-apps-logs\App1\*
  processors:
  - add_fields: 
      fields: 
        V_APP_NAME: Tena.Log.Tester1

- type: filestream
  id: techi-app2
  enabled: true
  paths:
    - C:\Users\60085367\Desktop\ElasticPrueba_8.4\multi-apps-logs\App2\*
  processors:
  - add_fields: 
      fields: 
        V_APP_NAME: Techi.Log.Tester2

- type: filestream
  id: serg-app3
  enabled: true
  paths:
    - C:\Users\60085367\Desktop\ElasticPrueba_8.4\multi-apps-logs\App3\*
  processors:
  - add_fields: 
      fields: 
        V_APP_NAME: Tam.Log.Tester3

  parsers:
    - multiline:
        type: pattern
        pattern: ^<log4j:event.*
        negate: true
        match: after
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:
  host: "tamca.tena.techi.net:5601"

output.logstash:
  hosts: ["0.0.0.0:5044"]

processors:
  - add_host_metadata:
      netinfo.enabled: true
  - add_fields: 
      fields:
        V_CODE_ENV: DEV
        V_CODE_REGION: TAM
        fields_under_root: true

```

Would this be a correct configuration?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2022, 8:42pm UTC](https://discuss.elastic.co/t/multiple-log-entries-in-filebeat-each-with-its-id-and-multiple-processors/314987/4 "2022-10-21T20:42:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.