86 lines
2.6 KiB
Text
86 lines
2.6 KiB
Text
//////////////////////////////////////////////////////////////////////////
|
|
//// This content is shared by all Filebeat inputs
|
|
//// If you add IDs to sections, make sure you use attributes to create
|
|
//// unique IDs for each input that includes this file. Use the format:
|
|
//// [id="{beatname_lc}-input-{type}-option-name"]
|
|
//////////////////////////////////////////////////////////////////////////
|
|
|
|
==== Common options
|
|
|
|
The following configuration options are supported by all inputs.
|
|
|
|
[float]
|
|
===== `enabled`
|
|
|
|
Use the `enabled` option to enable and disable inputs. By default, enabled is
|
|
set to true.
|
|
|
|
[float]
|
|
===== `tags`
|
|
|
|
A list of tags that {beatname_uc} includes in the `tags` field of each published
|
|
event. Tags make it easy to select specific events in Kibana or apply
|
|
conditional filtering in Logstash. These tags will be appended to the list of
|
|
tags specified in the general configuration.
|
|
|
|
Example:
|
|
|
|
["source","yaml",subs="attributes"]
|
|
-----
|
|
{beatname_lc}.inputs:
|
|
- type: {type}
|
|
. . .
|
|
tags: ["json"]
|
|
-----
|
|
|
|
|
|
[float]
|
|
[id="{beatname_lc}-input-{type}-fields"]
|
|
===== `fields`
|
|
|
|
Optional fields that you can specify to add additional information to the
|
|
output. For example, you might add fields that you can use for filtering log
|
|
data. Fields can be scalar values, arrays, dictionaries, or any nested
|
|
combination of these. By default, the fields that you specify here will be
|
|
grouped under a `fields` sub-dictionary in the output document. To store the
|
|
custom fields as top-level fields, set the `fields_under_root` option to true.
|
|
If a duplicate field is declared in the general configuration, then its value
|
|
will be overwritten by the value declared here.
|
|
|
|
["source","yaml",subs="attributes"]
|
|
-----
|
|
{beatname_lc}.inputs:
|
|
- type: {type}
|
|
. . .
|
|
fields:
|
|
app_id: query_engine_12
|
|
-----
|
|
|
|
[float]
|
|
[id="fields-under-root-{type}"]
|
|
===== `fields_under_root`
|
|
|
|
If this option is set to true, the custom
|
|
<<{beatname_lc}-input-{type}-fields,fields>> are stored as top-level fields in
|
|
the output document instead of being grouped under a `fields` sub-dictionary. If
|
|
the custom field names conflict with other field names added by {beatname_uc},
|
|
then the custom fields overwrite the other fields.
|
|
|
|
[float]
|
|
===== `processors`
|
|
|
|
A list of processors to apply to the input data.
|
|
|
|
See <<filtering-and-enhancing-data>> for information about specifying
|
|
processors in your config.
|
|
|
|
[float]
|
|
===== `pipeline`
|
|
|
|
The Ingest Node pipeline ID to set for the events generated by this input.
|
|
|
|
NOTE: The pipeline ID can also be configured in the Elasticsearch output, but
|
|
this option usually results in simpler configuration files. If the pipeline is
|
|
configured both in the input and output, the option from the
|
|
input is used.
|
|
|