Reading zookeeper log files -

I use puppet to maintain *beat across the fleet. If there is a *beat module in existence I just rename / replace it from the .disabled version.

What I don't see to have is a module for zookeeper. It produces a single file to /var/log/zookeeper and I'd like to ingest it. I've tried adding simple .yml files to /etc/filebeat/modules.d but they don't get picked up (IE I don't see filebeat reading the file).

Is it possible to add a simple .yml to /etc/filebeat/modules.d to read an arbitrary log file? Or do I need to write a custom module?

using elastic 7.11.1 across the board.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.