Referenced config files FileBeat (Windows)

Elastic Stack Logstash
1

Hi,

Recently we have successfully installed Filebeat on our (test) Windows server. Right now I’m investigating to find out the best deployment strategy for Filebeat agents on all of our Windows Server systems.

We would like to use the same config file (filebeat.yml) for all systems, except for the filebeat.inputs parts. Because Filebeat is using YML my idea is to reference the log file paths to another config file, see example:

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    include! C:\Sys\FileBeat\logref.yml

That way we can deploy the same filebeat.yml file on all systems, whenever there are specifics needs we only have to change the logref.yml on the local system.

However, when I configured it like this, no log data from the paths specified in logref.yml are appearing in Kibana/Elastic. The filebeat agent is starting succesfully on the other hand, so the config (syntax) seems fine.

I don't if this is possible at all, if not: Are there any other methods to use referenced config files?
Thank you!

2

Example of the logref.yml file:

# Log paths
    - D:\Loggingtest\logtest.txt
3

You should move this to the Beats forum, it has nothing to do with logstash.

4

It is possible, but it is a little different from what you are trying, you need to configure filebeat to load external configuration files as described in the documentation.

Basically you will have something like this in your filebeat.yml.

filebeat.config.inputs:
  enabled: true
  path: "C:/path/to/yml/configs/*.yml"

Then each file in the config dir needs to follow this example:

- type: filestream
  paths:
    - D:/path/to/file/file.txt

On a previous company I had a use case where I needed to collect logs from custom applications in Windows Servers, some applications where present in more than one server, others where present in just one server, to make things easier all the server have all the config files, if an application didn't exist in the server, filebeat will ignore it because the file to read won't exist.

5

Thank you very much!

6

I wonder if its also possible to define more than one path (referenced config file) in file.config.inputs?

7

I don't think so, the documentation does not mention this, also the name of the setting is path, not paths like the settings where you can have an array of paths.

Why would you need to define multiple config paths if in the config path you already can have multiple inputs?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.