Artem
01/14/2021, 1:22 PMGavin
01/14/2021, 1:38 PMfilebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/osqueryd.results.log
json.keys_under_root: true
fields_under_root: true
publisher_pipeline.disable_host: true
filebeat.config.modules:
# Glob pattern for configuration loading
path: ${path.config}/modules.d/*.yml
# Set to true to enable config reloading
reload.enabled: false
# Period on which files under path should be checked for changes
# reload.period: 10s
publisher_pipeline.disable_host: true
is a beats config to not try and fill in additional ECS metadata from the beats agent vs the original log source.Artem
01/14/2021, 2:16 PM