Multiple prospector path

[txisme]

Hey,

i want to use 2 prospectors, filebeal.yml is working perfect with just one;

However, if i uncomment the 2nd prospector, the filebeat fails to start:

---

After some trial and error i figured out that if i change the path of the 2nd prospector to anything else that doesn't have the same first folder (coriant), filebeat starts normally. Why is this happening?

[ruflin]

Can you share your config file in text format instead of screen shots? This makes it easier to read.

• Did you have 2 prospectors with the same files to harvest?
• Which filebeat version are you using?
• Can you provide some log outputs from filebeat?

[txisme]

Hey, thank you for your help, here is what you requested:

  prospectors:
# Each - is a prospector. Below are the prospector specific configurations
-
  # Paths that should be crawled and fetched. Glob based paths.
  # To fetch all ".log" files from a specific level of subdirectories
  # /var/log/*/*.log can be used.
  # For each file found under this path, a harvester is started.
  # Make sure not file is defined twice as this can lead to unexpected behaviour.
  paths:
  - "/coriant/sdn/logs/tc/Heap_Logs/*"
  #- c:\programdata\elasticsearch\logs\*
  input_type: log
  fields:
    log_type: heap
-
paths:
- "/coriant/sdn/logs/tc/GC_Logs/*"
input_type: log
fields:
log_type: GC

• 2 prospectors to different files (One to Heap_Logs, another to GC_Logs)

• im using filebeat 1.3

• here is the logging from filebeat, i havent seen it before, but still i dont understand what it meants, the file path is working fine for the first prospector but not for the second even though they are very similar

        2016-10-28T10:12:06+01:00 CRIT Config error: Error reading config file: YAML config parsing failed on          /etc/filebeat/filebeat.yml: yaml: unmarshal errors:
      line 148: cannot unmarshal !!str `/corian...` into config.ProspectorConfig. Exiting.

[ruflin]

Yaml is quite picky about the indentation (only spaces, no tabs). The above config file you posted looks like there are quite a few issues with the indentation. Best is to take the original config file and add your own values.

[txisme]

yeah i suspected it was that but i ve been doing this config file over and over. Maybe im doing always the same mistake. Will keep trying until YAML gets in better mood and accepts it. Thank you