filebeat.yml

###################### Filebeat Configuration Example #########################

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.
  - input_type: log
    paths:
      - /var/log/app-fb.log 
    fields:
      type : "normal"
    
    multiline.pattern: '^\['
    multiline.negate: true
    multiline.match: after
    document_type: app-log
  
  - input_type: log
    paths:
      - /var/log/nginx/access.log 
    fields:
      type : "access"
    document_type: nginx-access
#========================================================



#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  hosts: ["localhost:9200"]
  indices:
    - index: "normal-%{+yyyy.MM.dd}"
      when.equals:
        fields.type: "normal"
    - index: "access-%{+yyyy.MM.dd}"
      when.equals:
        fields.type: "access"
  pipelines:
    - pipeline: application_log_pipeline 
      when.equals:
        fields.type: "normal"
    - pipeline: access_log_pipeline
      when.equals:
        fields.type: "access"
#--------------------------------------------------------