filebeat.inputs: - type: filestream enabled: true paths: - /var/log/*.log filebeat.config.modules: path: ${path.config}/filebeat.modules.d/*.yml reload.enabled: false setup.template.settings: index.number_of_shards: 1 output.logstash: hosts: ["logstash.service:5044"] processors: - add_host_metadata: when.not.contains.tags: forwarded - add_cloud_metadata: ~