below is a hypothetical prospector setup. Many parameters are unique to a given prospector but some are identical (for instance, the multiline params). Is there a way to configure the filebeat.yml to extract the shared params into some roll up location? Thanks for any response.

filebeat.propectors:

type: log
paths:
/tmp/log/typeA*.log
multiline.pattern: '[0-9]
multiline.negate: true
multiline.match: after
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineA"
fields_under_root: true
fields:
logtype: TYPEA
type: log
paths:
/tmp/log/typeB*.log
multiline.pattern: '[0-9]
multiline.negate: true
multiline.match: after
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineB"
fields_under_root: true
fields:
logtype: TYPEB
type: log
paths:
/tmp/log/typeC*.log
multiline.pattern: '[0-9]
multiline.negate: true
multiline.match: after
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineC"
fields_under_root: true
fields:
logtype: TYPEC

0 Answers