Filebeat configuration depends on environment variables. Use case: when you want to run multiple filebeat service but in 1 created docker image. Let's contribute to provide a lot of flexibility configuration!

filebeat.yml

filebeat.inputs:
- type: container
  paths:
    - "/usr/share/dockerlogs/data/*/*.log"
  ignore_older: ${IGNORE_OLDER:10m}
  multiline.pattern: ${MULTILINE_PATTERN}
  multiline.negate: ${MULTILINE_NEGATE:false}
  multiline.match: ${MULTILINE_MATCH:after}

processors:
  - decode_json_fields:
      fields: ["log", "message"]
      target: ""
      overwrite_keys: true
  - add_docker_metadata:
      host: "unix:///var/run/docker.sock"
  - drop_event:
      when:
        or:
          - regexp:
              message: "${REGEX_MESSAGE_TO_DROP}"
          - regexp:
              container.image.name: "${REGEX_CONTAINER_IMAGE_TO_DROP}"

logging.level: error
logging.to_files: false
logging.to_syslog: false
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644
ssl.verification_mode: none

output.logstash:
  hosts: ["${LOGSTASH_ADDR:?You need to set the Logstash Address environment variable}:${LOGSTASH_PORT:?You need to set the Logstash Port environment variable}"]