filebeat.inputs:
  - type: filestream
    enabled: true
    paths:
      - "/var/log/*.log"
      - "/var/log/messages"
    exclude_lines: [".*mdnsd.*", ".*syslogd.*"]
  - type: filestream
    enabled: true
    paths:
      - "/var/log/*.json"
    fields_under_root: true
    json.message_key: message
    fields:
      tags: ["json"]

filebeat.config.modules:
  path: ${path.config}/filebeat.modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

output.logstash:
  hosts: ["logstash.service:5044"]

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~