CODEWITHSUNDEEP
logstashfilebeat
Amir Katz
Amir Katz

Reputation: 1037

Filebeat - Read from remote directory

Is it possible to set file beat to read from remote directory (Since I can't install the process on that machine)

I've set it up this way on the beats yml:

filebeat:
  # List of prospectors to fetch data.
  prospectors:
    # Each - is a prospector. Below are the prospector specific configurations
    -
      paths:
        - \\remotemachine\remotedir\*\*.log
      input_type: log
      document_type: RemoteLogs

Doesn't seem to work

Upvotes: 3

Views: 2883

Answers (2)

ElasticCode
ElasticCode

Reputation: 7875

We do not recommend reading log files from network volumes. Whenever possible, install Filebeat on the host machine and send the log files directly from there. Reading files from network volumes (especially on Windows) can have unexpected side effects. For example, changed file identifiers may result in Filebeat reading a log file from scratch again.

Filebeat Reference » Troubleshooting » Frequently asked questions

Upvotes: 3

Re_Paya
Re_Paya

Reputation: 71

it's not working like this.

it's recommend installing Filebeat on the remote servers/directory. Using shared folders is not supported!

The typical setup is that you have a Logstash + Elasticsearch + Kibana in a central place (one or multiple servers) and Filebeat installed on the remote machines from where you are collecting data.

Upvotes: 1

Related Questions