reference filebeat configuration

filebeat.config.yml

############################# Filebeat ######################################
filebeat:
  prospectors:
    -
      paths:
        - /var/log/<APP>/app.log
      fields:
        logzio_codec: plain
        token: ${token}
        application: app  # Custom field and value (can be filtered in logz.io)
        environment: ${logs_env}
        
      fields_under_root: true
      include_lines: "^(INFO|ERROR|CRIT|WARN|FATAL)"
      ignore_older: 24h
      document_type: <logzio_document_type>
      multiline:
        pattern: "^([.*] DEBUG|INFO|ERROR|CRIT|WARN|FATAL)"
        negate: true
        match: after
        max_lines: 500
        timeout: 5s
        
  registry_file: /var/lib/filebeat/registry
############################# AGENT Logs ##################################
logging:
  level: info
 
  # enable file rotation with default configuration
  to_files: true
 
  # do not log to syslog
  to_syslog: false
 
  files: #logs filebeat stuff
    path: /var/log/filebeat
    name: filebeat.log
    keepfiles: 7
############################# Output ##########################################
output:
  logstash:
    hosts: ["listener.logz.io:5015"]
    tls:
      certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
    ssl: #required for newer filebeat versions, do not work with tls anymore
      certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']