Using filebeat modules in conditions

Elastic Stack Beats
1

Assume i have 3 different systems sending different syslog formats to my server on port 514.

Using filebeat, i want to use modules in conditionals. eg. When a message field contains "pa" use the PANW module, but if the message field contains "something else" use a different module.

2

I'm not convinced if such routing is possible on the application level. You can configure filebeat inputs to follow different files, ports, but AFAIK there is no multiplexer.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.