Set order of filebeat inputs

Elastic Stack Beats
1

Hey,

I want to ship lines from Filebeat to Logstash in a specific input order. The reason I want to do that is that the documents of the second input are basing on the documents of the second input. This means I update those documents I have shipped at first.

I was thinking, that I could reduce the harvester to 1 because then Filebeat would read first the files of the first input before it starts to read the files of the second input, but I can't figure out, how Filebeat determines the order of inputs. Every time I start Filebeat the wrong input will be processed and Logstash throws exceptions because the documents do not exist (yet).

Is there a way to set the order somehow?
Or maybe any workaround?

Thank you and best regards,
Danny.

2

Filebeat does not offer any guarantees with ordering of the inputs. Perhaps you could look into using Elasticsearch's enrich processor?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.