From ed778d83a20805664ca6f1a841c76da2e4b3be74 Mon Sep 17 00:00:00 2001 From: Clement Beaujoin Date: Mon, 29 Sep 2025 09:49:54 +0200 Subject: [PATCH 1/2] fix issue #388 filebeat migrate from log to filetstream --- roles/beats/templates/filebeat.yml.j2 | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/roles/beats/templates/filebeat.yml.j2 b/roles/beats/templates/filebeat.yml.j2 index b77bd641..3c0a683d 100644 --- a/roles/beats/templates/filebeat.yml.j2 +++ b/roles/beats/templates/filebeat.yml.j2 @@ -2,7 +2,8 @@ filebeat.inputs: {% if beats_filebeat_log_input | bool %} {% for input in beats_filebeat_log_inputs %} -- type: log +- type: filestream + id: {{ input }}-filestream enabled: true paths: {% for path in beats_filebeat_log_inputs[input].paths %} @@ -22,31 +23,35 @@ filebeat.inputs: {% endif %} {% endif %} {% if beats_filebeat_log_inputs[input].multiline is defined %} - multiline: + parsers: + - multiline: {% if beats_filebeat_log_inputs[input].multiline.type is defined %} - type: {{ beats_filebeat_log_inputs[input].multiline.type }} + type: {{ beats_filebeat_log_inputs[input].multiline.type }} {% endif %} {% if beats_filebeat_log_inputs[input].multiline.pattern is defined %} - pattern: '{{ beats_filebeat_log_inputs[input].multiline.pattern }}' + pattern: '{{ beats_filebeat_log_inputs[input].multiline.pattern }}' {% endif %} {% if beats_filebeat_log_inputs[input].multiline.negate is defined %} - negate: {{ beats_filebeat_log_inputs[input].multiline.negate }} + negate: {{ beats_filebeat_log_inputs[input].multiline.negate }} {% endif %} {% if beats_filebeat_log_inputs[input].multiline.match is defined %} - match: {{ beats_filebeat_log_inputs[input].multiline.match }} + match: {{ beats_filebeat_log_inputs[input].multiline.match }} {% endif %} {% endif %} {% endfor %} {% endif %} {% if beats_filebeat_mysql_slowlog_input | bool %} -- type: log +- type: filestream + id: mysql-slowlog-filestream enabled: true paths: - /var/log/mysql/*-slow.log - multiline.pattern: '^\#[[:space:]]Time' - multiline.negate: true - multiline.match: after + parsers: + - multiline: + pattern: '^\#[[:space:]]Time' + negate: true + match: after fields: mysql: logtype: slowquery From 3bf0d6fa61d6f9bc7a0219181b85c1202d27ca90 Mon Sep 17 00:00:00 2001 From: Clement Beaujoin Date: Mon, 29 Sep 2025 10:32:43 +0200 Subject: [PATCH 2/2] fix indentation --- roles/beats/templates/filebeat.yml.j2 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/beats/templates/filebeat.yml.j2 b/roles/beats/templates/filebeat.yml.j2 index 3c0a683d..cbddb8aa 100644 --- a/roles/beats/templates/filebeat.yml.j2 +++ b/roles/beats/templates/filebeat.yml.j2 @@ -26,16 +26,16 @@ filebeat.inputs: parsers: - multiline: {% if beats_filebeat_log_inputs[input].multiline.type is defined %} - type: {{ beats_filebeat_log_inputs[input].multiline.type }} + type: {{ beats_filebeat_log_inputs[input].multiline.type }} {% endif %} {% if beats_filebeat_log_inputs[input].multiline.pattern is defined %} - pattern: '{{ beats_filebeat_log_inputs[input].multiline.pattern }}' + pattern: '{{ beats_filebeat_log_inputs[input].multiline.pattern }}' {% endif %} {% if beats_filebeat_log_inputs[input].multiline.negate is defined %} - negate: {{ beats_filebeat_log_inputs[input].multiline.negate }} + negate: {{ beats_filebeat_log_inputs[input].multiline.negate }} {% endif %} {% if beats_filebeat_log_inputs[input].multiline.match is defined %} - match: {{ beats_filebeat_log_inputs[input].multiline.match }} + match: {{ beats_filebeat_log_inputs[input].multiline.match }} {% endif %} {% endif %}