filebeat config file example

filebeat.yml

#Global options
filebeat.shutdown_timeout: 3s

##Logging
logging.level: error
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644
metrics_enabled: false
metrics_period: 15s

##Prospectors
filebeat.inputs:
- type: log
  paths:
    - /var/log/haproxy/info.log
  fields:
    stand: dev1
    origin: system
    application: haproxy
    level: info
  fields_under_root: true

- type: log
  paths:
    - /var/log/haproxy/notice.log
  fields:
    stand: dev1
    origin: system
    application: haproxy
    level: notice
  fields_under_root: true

- type: log
  paths:
    - /home/ubuntu/.pm2/logs/parity-classic-error.log
  fields:
    stand: dev1
    origin: system
    application: parity_classic
  fields_under_root: true

- type: log
  paths:
    - /home/ubuntu/.pm2/logs/parity-foundation-error.log
  fields:
    stand: dev1
    origin: system
    application: parity_foundation
  fields_under_root: true

- type: log
  paths:
   - '/var/lib/docker/containers/*/*.log'
  json.message_key: log # JSON key name, which value contains a sub JSON document
  json.keys_under_root: true
  fields:
    stand: dev1
    origin: docker
  fields_under_root: true
  processors:
  - add_docker_metadata:
      host: "unix:///var/run/docker.sock"
  - decode_json_fields:
      fields: ["log", "attrs.com.docker.compose"]
      target: ""
      overwrite_keys: true

output.logstash:
  hosts: ["some-logstash-host:5045"]