Recently we have successfully installed Filebeat on our (test) Windows server. Right now I’m investigating to find out the best deployment strategy for Filebeat agents on all of our Windows Server systems.
We would like to use the same config file (filebeat.yml) for all systems, except for the filebeat.inputs parts. Because Filebeat is using YML my idea is to reference the log file paths to another config file, see example:
# Paths that should be crawled and fetched. Glob based paths.
That way we can deploy the same filebeat.yml file on all systems, whenever there are specifics needs we only have to change the logref.yml on the local system.
However, when I configured it like this, no log data from the paths specified in logref.yml are appearing in Kibana/Elastic. The filebeat agent is starting succesfully on the other hand, so the config (syntax) seems fine.
I don't if this is possible at all, if not: Are there any other methods to use referenced config files?
On a previous company I had a use case where I needed to collect logs from custom applications in Windows Servers, some applications where present in more than one server, others where present in just one server, to make things easier all the server have all the config files, if an application didn't exist in the server, filebeat will ignore it because the file to read won't exist.