...
Logstash can receive in its input raw data send by multiple Filebeat forwarders. In order to do this, each Fliebeat should be configured to send its data to the Logstash along Logstash along with proper tagging for each log.
Technical Details
The Filebeat configuration file should look like the following:
...
fields: {apptags: "<APPTAG_1,APPTAG_2,APPTAG_N>",app: "<FOLDER_NAME>", logname: "<LOG_NAME>", filename: beat.source <HOST_NAME>}
# fields - apptags - the apptags that this log (s) will be tagged to in XpoLog - there can be more than one tag comma separated. app
# app - the folder in the Folders and Logs that this log(s) will be placed
# logname - the logname in XpoLog
# logname - the host name were the log of is originated from
# To add more than one log create another set of properties for the additional log
...
# - FULL_PATH_TO_LOGS_DIRECTORY/FILE
#fields: {apptags: "App1,NJ<APPTAG_NAME>",app: "App1<FOLDER_NAME>", logname: "App1_LOG_NAME_2"<LOG_NAME>", filename: <HOST_NAME>}
filebeat.config.modules:
...