filebeat 配置多yml文件 版本 ELK v7.17 filebeat 7.17

[潦草的人生]

有一些自定的 yml 文件单独配置没有问题，但是合并这些 .yml 文件产生了问题。

想问问是否有相关的比较全一些的示例，可以参考，我希望能自己去研究研究。。。

结构如下

filebeat.yml

--config

     config1.yml

     config2.yml

 

bin/filebeat  -c filebeat.yml

可以包含 所有config的输入。。。

[潦草的人生]

解决了
filebeat.yml 文件

filebeat.config.inputs:
  enabled: true
  path: ${path.config}/configs/*.yml
  reload.enabled: true
  reload.period: 10s


# ============================== Filebeat modules ==============================
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
  reload.period: 10s

# ======================= Elasticsearch template setting =======================

setup.template.settings:
  index.number_of_shards: 1
  #index.codec: best_compression
  #_source.enabled: false


# ================================== General ===================================


# ================================= Dashboards =================================

# =================================== Kibana ===================================

# =============================== Elastic Cloud ================================

# ================================== Outputs ===================================


# ---------------------------- Elasticsearch Output ----------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

  # Protocol - either `http` (default) or `https`.
  #protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  #username: "elastic"
  #password: "changeme"

# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["127.0.0.1:9900"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

# ================================= Processors =================================
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

# ================================== Logging ===================================

# ============================= X-Pack Monitoring ==============================

# ============================== Instrumentation ===============================

# ================================= Migration ==================================

config1.yml

- type: log
  enabled: true
  paths:
    - /root/logstash_test/test_data/config1.log
  multiline.type: pattern
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after
  fileds:
    data_type: config1

config2.yml

- type: log
  enabled: true
  paths:
    - /root/logstash_test/test_data/config2.log
  multiline.type: pattern
  multiline.pattern: '^\SET'
  multiline.negate: true
  multiline.match: after
  fileds:
    data_type: config2