如何整合filebeat.prospector属性

时间:2019-04-29 12:04:24

标签: elastic-stack filebeat

以下是假设的探矿者设置。对于给定的探矿者,许多参数是唯一的,但有些参数是相同的(例如,多行参数)。有没有一种方法可以配置filebeat.yml以将共享参数提取到某个汇总位置?感谢您的答复。

filebeat.propectors:

type: log
paths:
/tmp/log/typeA*.log
multiline.pattern: '[0-9]
multiline.negate: true
multiline.match: after
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineA"
fields_under_root: true
fields:
logtype: TYPEA
type: log
paths:
/tmp/log/typeB*.log
multiline.pattern: '[0-9]
multiline.negate: true
multiline.match: after
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineB"
fields_under_root: true
fields:
logtype: TYPEB
type: log
paths:
/tmp/log/typeC*.log
multiline.pattern: '[0-9]
multiline.negate: true
multiline.match: after
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineC"
fields_under_root: true
fields:
logtype: TYPEC

0 个答案:

没有答案