# 可参考 https://www.elastic.co/guide/en/beats/filebeat/7.14/filebeat-reference-yml.html

# 收集系统日志
filebeat:
  inputs:
    - type: log
      enabled: true
      paths:
        - /usr/share/filebeat/my-log/demo*.log
      tags: [ "demo" ]
      # java多行日志合并
      multiline:
        pattern: '^\d{4}\-\d{2}\-\d{2}\s\d{2}:\d{2}:\d{2}' # 匹配的正则 不是以 2021-10-01 12:00:00 格式开头的将合并到上一行
        negate: true                                       # 是否反向匹配
        match: after                                       # 取值为 after 则放到上一行之后，取值为 before 则放到下一行之前
        timeout: 3s


# 输出到elasticsearch
output.elasticsearch:
  hosts: [ "elasticsearch:9200" ] # ES地址，可以有多个，用逗号","隔开
  username: "elastic"             # ES用户名
  password: "123456"              # ES密码
  indices:
    - index: "demo-%{+yyyy.MM.dd}"     # 以日期为后缀，每天新建一个索引
      when.contains:
        tags: "demo"