Multiple prospectors in filebeat

[chandra0651 (Chandra Reddy Kosna)]

Hi i have 10 different type of log files in one folder which all end with ".log" as of now i have been using one prospector to poll all the data using "/.log" as path but now i have to change some multiline settings for one of the log file. can i use two prospectors one with "/*.log" and one with something like "/1.log". Will this setting pull the logs from "1.log" once or twice

• type: log
  enabled: true
  paths:

  • /opt/logs/*.log
    multiline.pattern:
    multiline.negate: true
    multiline.match: after

• type: log
  enabled: true
  paths:

  • /opt/logs/1.log
    multiline.pattern:
    multiline.negate: true
    multiline.match: after

[kvch (Noémi Ványi)]

Yes, the prospector configured to read paths *.log will try to read 1.log, too. Do not try to read from the same file using multiple prospectors.
You could set the option exclude_files of your prospector which has the wildcard path: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-exclude-files

- type: log
  enabled: true
  paths:
   - /opt/logs/*.log
  exclude_files: ['/opt/logs/1.log']