Hi Magnus.
I reviewed the filebeat.yml file and I found errors in section path.
Misssing dashes between the path settings. See the example with error:
paths:
- /var/log/apache2/*_access.log
input_type: log
document_type: apache-access
paths:
- /var/log/apache2/*_error.log
input_type: log
document_type: apache-error
paths:
- /var/log/apache2/*_transfer.log
input_type: log
document_type: apache-transfer
paths:
- /var/log/auth.log
- /var/log/syslog
input_type: log
document_type: syslog
See the example without error:
**-**
paths:
- /var/log/apache2/*_access.log
input_type: log
document_type: apache-access
**-**
paths:
- /var/log/apache2/*_error.log
input_type: log
document_type: apache-error
**-**
paths:
- /var/log/apache2/*_transfer.log
input_type: log
document_type: apache-transfer
**-**
paths:
- /var/log/auth.log
- /var/log/syslog
input_type: log
document_type: syslog
No dashes, the filebeat always considered the last line of the path section. For this reason always document_type was the syslog and never had the classification as apache.
Thank you very much for your help.