3

Is it possible to set file beat to read from remote directory (Since I can't install the process on that machine)

I've set it up this way on the beats yml:

filebeat:
  # List of prospectors to fetch data.
  prospectors:
    # Each - is a prospector. Below are the prospector specific configurations
    -
      paths:
        - \\remotemachine\remotedir\*\*.log
      input_type: log
      document_type: RemoteLogs

Doesn't seem to work

ElasticCode
  • 7,311
  • 2
  • 34
  • 45
Amir Katz
  • 1,027
  • 1
  • 10
  • 24

2 Answers2

3

We do not recommend reading log files from network volumes. Whenever possible, install Filebeat on the host machine and send the log files directly from there. Reading files from network volumes (especially on Windows) can have unexpected side effects. For example, changed file identifiers may result in Filebeat reading a log file from scratch again.

Filebeat Reference » Troubleshooting » Frequently asked questions

ElasticCode
  • 7,311
  • 2
  • 34
  • 45
1

it's not working like this.

it's recommend installing Filebeat on the remote servers/directory. Using shared folders is not supported!

The typical setup is that you have a Logstash + Elasticsearch + Kibana in a central place (one or multiple servers) and Filebeat installed on the remote machines from where you are collecting data.

Re_Paya
  • 71
  • 8