I am setting up Elastic Filebeat Log monitoring for an application. My filebeat.yml contains 9 inputs covering 9 different log files. For each input, I am having to put the multiline properties (type, pattern, negate, match), which makes the file very long and verbose. Is there a way to specify the multiline properties once for all inputs rather than for each input?
My filebeat.yml looks as follows for each input: - type: log enabled: true paths: - /apps/myapp/logs/ServerLogs.log multiline.type: pattern multiline.pattern: [SomeRegex] multiline.negate: true multiline.match: after
I tried to put the multiline properties without indentation and not as part of the filebeat.inputs section, however the multiline properties then didn't take affect.
