Multiple prospectors in filebeat

Elastic Stack Beats
1

Hi i have 10 different type of log files in one folder which all end with ".log" as of now i have been using one prospector to poll all the data using "/.log" as path but now i have to change some multiline settings for one of the log file. can i use two prospectors one with "/*.log" and one with something like "/1.log". Will this setting pull the logs from "1.log" once or twice

  • type: log
    enabled: true
    paths:

    • /opt/logs/*.log
      multiline.pattern:
      multiline.negate: true
      multiline.match: after

  • type: log
    enabled: true
    paths:

    • /opt/logs/1.log
      multiline.pattern:
      multiline.negate: true
      multiline.match: after
2

Yes, the prospector configured to read paths *.log will try to read 1.log, too. Do not try to read from the same file using multiple prospectors.
You could set the option exclude_files of your prospector which has the wildcard path: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-exclude-files

- type: log
  enabled: true
  paths:
   - /opt/logs/*.log
  exclude_files: ['/opt/logs/1.log']
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.