Using filebeat modules in conditions

ajhstn · June 24, 2020, 6:14am

Assume i have 3 different systems sending different syslog formats to my server on port 514.

Using filebeat, i want to use modules in conditionals. eg. When a message field contains "pa" use the PANW module, but if the message field contains "something else" use a different module.

mtojek · June 24, 2020, 9:06am

I'm not convinced if such routing is possible on the application level. You can configure filebeat inputs to follow different files, ports, but AFAIK there is no multiplexer.

Topic		Replies	Views
Different modules? Beats docker , filebeat	4	274	December 11, 2020
How to properly use two Filebeat modules listening on the same port? Beats docker , filebeat	6	967	December 28, 2022
Filebeat: How to differentiate data from different types sources on same port? Beats filebeat	4	819	September 30, 2020
Howto ingest from application logs and modules? Beats beats-module , filebeat	2	379	June 8, 2021
Using filebeat modules with custom fields Beats filebeat	4	1108	May 18, 2020

Using filebeat modules in conditions

Related topics