| 123456789101112131415161718192021222324252627282930 |
- setup.ilm.enabled: false
- setup.template.enabled: true
- setup.template.name: "{{ansible_hostname}}-log"
- setup.template.pattern: "{{ansible_hostname}}-log-*"
- setup.template.overwrite: true
- filebeat.inputs:
- - type: log
- enabled: true
- paths:
- - /var/log/auth.log
- - /var/log/caddy.access.log
- - /var/log/messages
- - /usr/local/etc/unbound/unbound.log
- json.add_error_key: true # Add an error key if JSON parsing fails
- processors:
- - decode_json_fields:
- fields: ["msg"] # Parse the "msg" field (assuming it's a string containing JSON)
- target: "msg" # The parsed output will be under a new field "msg_parsed"
- overwrite_keys: true # Optionally overwrite the "msg" field
- output.elasticsearch:
- hosts: ["http://log.service:5080"]
- timeout: 10
- path: "/api/default/"
- index: default
- username: "openobserve@unbl.ink"
- password: "{{openobserve_password}}"
|
