-1

I have an input settings like this (Proof Of Concept) and i will add more prospectors further on.

Can i avoid repetition of the multiline properties?

filebeat.prospectors:
  - type: log
    enabled: true
    paths:
      - /data/server/logs/inode-stage/inode-stage.log
    multiline.pattern: '^\['
    multiline.negate: true
    multiline.match: after
    fields:
      env: 'stage'
      app: 'inode'
  - type: log
    enabled: true
    paths:
      - /data/server/logs/inode-dev/inode-dev.log
    multiline.pattern: '^\['
    multiline.negate: true
    multiline.match: after
    fields:
      env: 'dev'
      app: 'inode'
oygen
  • 467
  • 1
  • 7
  • 13

1 Answers1

0

I don't think that is possible right now. Not sure how many variations you will have in your inputs, but based on your current example I would extract the env with dissect. If you need something more powerful, you could even go for the script processor.

xeraa
  • 10,456
  • 3
  • 33
  • 66