By default, Filebeat would have a config file at /etc/filebeat/filebeat.yml. This contains all the required parameters related to input, tags, output, and more. It even has a set of predefined modules that can be enabled/disabled in filebeat.yml for getting all Cassandra-related logs to be shipped as follows:
filebeat.inputs:- type: log enabled: true paths: - /usr/lib/Cassandra/logs/*.log multiline.pattern: '^[[:space:]]' multiline.negate: false multiline.match: after
So based on our flexibility, we can customize it accordingly for all the logs that need to be shipped. Moreover, it has compatibility of multiline, because during exceptions it would be annoying if they are not part of same message being shipped to the backend. ...
