filebeat.inputs: - type: filestream enabled: true paths: - "/var/log/*.log" exclude_lines: [".*mdnsd.*", ".*syslogd.*"] filebeat.config.modules: path: ${path.config}/filebeat.modules.d/*.yml reload.enabled: false setup.template.settings: index.number_of_shards: 1 output.logstash: hosts: ["logstash.service:5044"] processors: - add_host_metadata: when.not.contains.tags: forwarded - add_cloud_metadata: ~