第一種方法：

vim /etc/filebeat/filebeat.yml

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true
  harvester_limit: 100
  #close_eof : true
  close_inactive : 10m
  #close_timeout : true
  ignore_older : 72h
  clean_inactive : 73h
  scan_frequency: 10s
# Paths that should be crawled and fetched. Glob based paths.
  json.keys_under_root: true
  paths:
     - /etc/logs/*.log
     - /var/www/logs/*.logs
  

第二種方法，增加個tag字段，區分不同地方的log，建議使用

- type: log

  # Change to true to enable this input configuration.
  #enabled: false
  enabled: true
  harvester_limit: 100
  close_inactive: 10m
  ignore_older: 168h
  clen_inactive: 170h
  scan_frequency: 10s
  json.keys_under_root: true
  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
  tags: ["all"]

- type: log

  # Change to true to enable this input configuration.
  #enabled: false
  enabled: true
  harvester_limit: 100
  close_inactive: 10m
  ignore_older: 168h
  clen_inactive: 170h
  scan_frequency: 10s
  json.keys_under_root: true
  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /opt/logs/test.log
  tags: ["only_test"]

filebeat配置不同路徑下的log的兩種方法