I am using linux centos.
This is my filebeat.yml file.
#=========================== Filebeat inputs =============================
filebeat.inputs:
-
type: log
enabled: true
paths:- /ip/logs/ip
fields: { log_type: ip }
- /ip/logs/ip
-
type: log
enabled: true
paths:- /ip/logs/p13n.log
fields: { log_type: p13n }
- /ip/logs/p13n.log
-
type: log
enabled: true
paths:- /ip/logs/ipreport.log
fields: { log_type: ipreport }
- /ip/logs/ipreport.log
-
type: log
enabled: true
paths:- /ip/logs/ipwconnect.log
fields: { log_type: ipwconnect }
- /ip/logs/ipwconnect.log
and here is the logstash.conf :
input {
beats {
port => "5044"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "%{[fields][log_type]}-log"
}
}
All the indexes are getting created, but only one of the index is showing the data. The rest of the indexes got some data for some seconds, but then it stopped.
Please help me out here.
Thank you