filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/fundplatform/fund-sys-json.log
    - /var/log/fundplatform/fund-proj-json.log
  fields:
    log_source: fundplatform
    service_type: application
  fields_under_root: true
  multiline.pattern: '^\{'
  multiline.negate: true
  multiline.match: after
  json.keys_under_root: true
  json.add_error_key: true

- type: log
  enabled: true
  paths:
    - /var/log/fundplatform/fund-sys-error.log
  fields:
    log_source: fundplatform
    service_type: error
    log_level: error
  fields_under_root: true

# 容器日志收集
- type: container
  paths:
    - '/var/lib/docker/containers/*/*.log'
  processors:
    - add_docker_metadata:
        host: "unix:///var/run/docker.sock"

# 输出到Logstash
output.logstash:
  hosts: ["logstash:5044"]
  enabled: true

# 处理器
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~

# 日志级别
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644