How to configure Filebeat inputs

Configuring Filebeat inputs determines which log files or data sources are collected. By specifying paths, multiline settings, or exclude patterns, you control what data is forwarded.

Filebeat supports multiple input types like log files, syslog, or modules. Proper configuration ensures only relevant data is ingested, reducing noise and storage costs.

Well-tuned inputs provide cleaner, more focused datasets for Logstash or Elasticsearch consumption.

1. Open the main Filebeat configuration file.

   $ sudo nano /etc/filebeat/filebeat.yml
   (no direct output)

   Locate the filebeat.inputs section in the YAML file.

2. Add a type: log input and specify file paths.

   Use wildcards in paths if logs are split by date or host.

3. Configure exclude_lines or include_lines to filter logs.
4. Enable multiline settings if a single event spans multiple lines.
5. Test configuration.

   $ sudo filebeat test config
   Config OK

   Incorrect file paths or YAML syntax can break the configuration.

6. Restart Filebeat to apply changes.

   $ sudo systemctl restart filebeat
   (no output)

   Check Filebeat logs to confirm new inputs are being processed.