Configure inputs

To configure Filebeat manually (instead of using modules), you specify a list of inputs in the filebeat.inputs section of the filebeat.yml. Inputs specify how Filebeat locates and processes input data.

The list is a YAML array, so each input begins with a dash (-). You can specify multiple inputs, and you can specify the same input type more than once. For example:

filebeat.inputs:
- type: filestream
  id: my-filestream-id 
  paths:
    - /var/log/system.log
    - /var/log/wifi.log
- type: filestream
  id: apache-filestream-id
  paths:
    - "/var/log/apache2/*"
  fields:
    apache: true
  fields_under_root: true

For the most basic configuration, define a single input with a single path. For example:

filebeat.inputs:
- type: filestream
  id: my-filestream-id
  paths:
    - /var/log/*.log

The input in this example harvests all files in the path /var/log/*.log, which means that Filebeat will harvest all files in the directory /var/log/ that end with .log. All patterns supported by Go Glob are also supported here.

To fetch all files from a predefined level of subdirectories, use this pattern: /var/log/*/*.log. This fetches all .log files from the subfolders of /var/log. It does not fetch log files from the /var/log folder itself. Currently it is not possible to recursively fetch all files in all subdirectories of a directory.

You can configure Filebeat to use the following inputs: