<div id="readability-page-1" class="page"><div id="post-body-4615338626507399488" itemprop="articleBody">
filebeat 설정.
<div><pre><code>filebeat.inputs:- type: filestream&nbsp; id: my-filestream-id&nbsp; enabled: true&nbsp; paths:&nbsp; &nbsp; - d:\firewall.log&nbsp; prospector.scanner.fingerprint.enabled: falsefilebeat.config.modules:&nbsp; path: ${path.config}/modules.d/*.yml&nbsp; reload.enabled: falsesetup.template.settings:&nbsp; index.number_of_shards: 1<a name="more"></a>output.console:&nbsp; pretty: trueprocessors:&nbsp; - include_fields:&nbsp; &nbsp; &nbsp; fields: ["log.file.path", "message"]</code></pre></div><div><pre><code>{&nbsp; "@timestamp": "2025-06-27T13:24:11.549Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "log": {&nbsp; &nbsp; "file": {&nbsp; &nbsp; &nbsp; "path": "d:\\firewall.log"&nbsp; &nbsp; }&nbsp; },&nbsp; "message": "2025-06-24 15:44:30 ALLOW UDP 192.168.31.177 142.250.207.100 64118 443 0 - - - - - - - SEND"}</code></pre></div>

연동 데이터를 추가하면?
<div><pre><code>filebeat.inputs:- type: filestream&nbsp; id: my-filestream-id&nbsp; enabled: true&nbsp; paths:&nbsp; &nbsp; - d:\firewall.log&nbsp; &nbsp; - d:\auditbeat.log</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-06-27T13:25:50.441Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "log": {&nbsp; &nbsp; "file": {&nbsp; &nbsp; &nbsp; "path": "d:\\auditbeat.log"&nbsp; &nbsp; }&nbsp; },&nbsp; "message": "{\"@timestamp\":\"2025-06-25T09:40:17.236Z\",\"@metadata\":{\"beat\":\"auditbeat\",\"type\":\"_doc\",\"version\":\"8.12.0\"},\"event\":{\"kind\":\"event\",\"category\":[\"process\"],\"type\":[\"end\"],\"action\":\"process_stopped\",\"module\":\"system\",\"dataset\":\"process\"},\"ecs\":{\"version\":\"8.0.0\"},\"host\":{\"name\":\"MHKANG\"},\"agent\":{\"version\":\"8.12.0\",\"ephemeral_id\":\"013c425b-7951-4670-ab30-7432708042cd\",\"id\":\"5d624028-d6db-4bf3-9930-2739c9b72407\",\"name\":\"MHKANG\",\"type\":\"auditbeat\"},\"process\":{\"parent\":{\"pid\":1636},\"hash\":{\"sha1\":\"119965512252f4da4ac86887562e0d4ad4f2d4c3\"},\"entity_id\":\"1vfinYF9dclwaAOM\",\"pid\":216868,\"executable\":\"C:\\\\Splunk\\\\bin\\\\python3.exe\",\"start\":\"2025-06-25T09:40:05.187Z\",\"name\":\"python3.exe\",\"args\":[\"C:\\\\Splunk\\\\bin\\\\Python3.exe\",\"C:\\\\Splunk\\\\bin\\\\runScript.py\",\"rest_vocabularies.Vocabularies\"],\"working_directory\":\"C:\\\\Splunk\\\\bin\"},\"message\":\"Process python3.exe (PID: 216868) by user NT AUTHORITY\\\\SYSTEM STOPPED\",\"user\":{\"group\":{\"id\":\"S-1-5-18\"},\"name\":\"NT AUTHORITY\\\\SYSTEM\",\"id\":\"S-1-5-18\"},\"service\":{\"type\":\"system\"}}"}</code></pre></div>
<div>추가된 데이터만 가져온다. 항상 그렇지는 않은데 왔다갔다 하면서 하나만 가져온다.&nbsp;<a href="https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream#filestream-input-paths" target="_blank">공식문서</a>는 여러 개 지정할 수 있는 것처럼 설명하는데 버그인가? 다음 설정도 마찬가지.<div><pre><code>filebeat.inputs:- type: filestream&nbsp; id: my-filestream-id&nbsp; enabled: true&nbsp; paths:&nbsp; &nbsp; - d:\*.log</code></pre></div></div>
<div><pre><code>filebeat.inputs:- type: filestream&nbsp; id: my-filestream-id1&nbsp; enabled: true&nbsp; paths:&nbsp; &nbsp; - d:\firewall.log&nbsp; prospector.scanner.fingerprint.enabled: false- type: filestream&nbsp; id: my-filestream-id2&nbsp; enabled: true&nbsp; paths:&nbsp; &nbsp; - d:\auditbeat.log&nbsp; prospector.scanner.fingerprint.enabled: false&nbsp;&nbsp;</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-06-27T13:30:19.791Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "log": {&nbsp; &nbsp; "file": {&nbsp; &nbsp; &nbsp; "path": "d:\\firewall.log"&nbsp; &nbsp; }&nbsp; },&nbsp; "message": "2025-06-24 15:44:30 ALLOW UDP 192.168.31.177 142.250.207.100 64118 443 0 - - - - - - - SEND"}{&nbsp; "@timestamp": "2025-06-27T13:30:19.791Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "log": {&nbsp; &nbsp; "file": {&nbsp; &nbsp; &nbsp; "path": "d:\\auditbeat.log"&nbsp; &nbsp; }&nbsp; },&nbsp; "message": "{\"@timestamp\":\"2025-06-25T09:40:17.236Z\",\"@metadata\":{\"beat\":\"auditbeat\",\"type\":\"_doc\",\"version\":\"8.12.0\"},\"event\":{\"kind\":\"event\",\"category\":[\"process\"],\"type\":[\"end\"],\"action\":\"process_stopped\",\"module\":\"system\",\"dataset\":\"process\"},\"ecs\":{\"version\":\"8.0.0\"},\"host\":{\"name\":\"MHKANG\"},\"agent\":{\"version\":\"8.12.0\",\"ephemeral_id\":\"013c425b-7951-4670-ab30-7432708042cd\",\"id\":\"5d624028-d6db-4bf3-9930-2739c9b72407\",\"name\":\"MHKANG\",\"type\":\"auditbeat\"},\"process\":{\"parent\":{\"pid\":1636},\"hash\":{\"sha1\":\"119965512252f4da4ac86887562e0d4ad4f2d4c3\"},\"entity_id\":\"1vfinYF9dclwaAOM\",\"pid\":216868,\"executable\":\"C:\\\\Splunk\\\\bin\\\\python3.exe\",\"start\":\"2025-06-25T09:40:05.187Z\",\"name\":\"python3.exe\",\"args\":[\"C:\\\\Splunk\\\\bin\\\\Python3.exe\",\"C:\\\\Splunk\\\\bin\\\\runScript.py\",\"rest_vocabularies.Vocabularies\"],\"working_directory\":\"C:\\\\Splunk\\\\bin\"},\"message\":\"Process python3.exe (PID: 216868) by user NT AUTHORITY\\\\SYSTEM STOPPED\",\"user\":{\"group\":{\"id\":\"S-1-5-18\"},\"name\":\"NT AUTHORITY\\\\SYSTEM\",\"id\":\"S-1-5-18\"},\"service\":{\"type\":\"system\"}}"}</code></pre></div>


<div><pre><code>filebeat.inputs:- type: filestream&nbsp; id: my-filestream-id1&nbsp; enabled: true&nbsp; paths:&nbsp; &nbsp; - d:\firewall.log&nbsp; prospector.scanner.fingerprint.enabled: false&nbsp;&nbsp;index: "firewall-%{+yyyy}"- type: filestream&nbsp; id: my-filestream-id2&nbsp; enabled: true&nbsp; paths:&nbsp; &nbsp; - d:\auditbeat.log&nbsp; prospector.scanner.fingerprint.enabled: false&nbsp; index: "auditlog-%{+yyyy}"&nbsp;</code></pre></div>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTC6SLl5uA_02Nck9WGCnefWET6gbtOjxWF-hJ9uXvD2v2Vu4ctt-MJtsOYBL-BDJsIiqfs-JyDihAVsno7_70eyAPu3CY3u2EXo9D7Guy4S0RBF2Vg0_goSHahA-H1Iq0RfSZ_DO7sU5hkoIfx9Fcl1mRjwLr2W-BUiWpzy6PcGgH9BslHTfuq7l8houp/s1636/index.png"><img data-original-height="616" data-original-width="1636" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTC6SLl5uA_02Nck9WGCnefWET6gbtOjxWF-hJ9uXvD2v2Vu4ctt-MJtsOYBL-BDJsIiqfs-JyDihAVsno7_70eyAPu3CY3u2EXo9D7Guy4S0RBF2Vg0_goSHahA-H1Iq0RfSZ_DO7sU5hkoIfx9Fcl1mRjwLr2W-BUiWpzy6PcGgH9BslHTfuq7l8houp/s16000/index.png"></a>
커스텀 인덱스 만드는 거 쉬웠군. 공식 문서를 꼼꼼히 읽지 않으면 언제나 조져지는 건 나(..)<div>
 <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaJTni47b88M13rNtCOnQ_FomHsnFf_XAj8WRTtbefTE-Z_mMytiJSdr47ryMqRXduvnxls9_mzqANqHb-7zeAN2D_K2_lw_o0DateT9AogcYF1IWs1mwh3TJpa_0tsJOfLvfKIBoXa6WM/s960/i16170403443.jpg"><img data-original-height="960" data-original-width="956" height="281" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaJTni47b88M13rNtCOnQ_FomHsnFf_XAj8WRTtbefTE-Z_mMytiJSdr47ryMqRXduvnxls9_mzqANqHb-7zeAN2D_K2_lw_o0DateT9AogcYF1IWs1mwh3TJpa_0tsJOfLvfKIBoXa6WM/w318-h320/i16170403443.jpg" width="280"></a></div>

</div></div>

케세라세라

filebeat 설정.
filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - d:\firewall.log
  prospector.scanner.fingerprint.enabled: false
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
output.console:
  pretty: true
processors:
  - include_fields:
      fields: ["log.file.path", "message"]
{
  "@timestamp": "2025-06-27T13:24:11.549Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "log": {
    "file": {
      "path": "d:\\firewall.log"
    }
  },
  "message": "2025-06-24 15:44:30 ALLOW UDP 192.168.31.177 142.250.207.100 64118 443 0 - - - - - - - SEND"
}
연동 데이터를 추가하면?
filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - d:\firewall.log
    - d:\auditbeat.log
{
  "@timestamp": "2025-06-27T13:25:50.441Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "log": {
    "file": {
      "path": "d:\\auditbeat.log"
    }
  },
  "message": "{\"@timestamp\":\"2025-06-25T09:40:17.236Z\",\"@metadata\":{\"beat\":\"auditbeat\",\"type\":\"_doc\",\"version\":\"8.12.0\"},\"event\":{\"kind\":\"event\",\"category\":[\"process\"],\"type\":[\"end\"],\"action\":\"process_stopped\",\"module\":\"system\",\"dataset\":\"process\"},\"ecs\":{\"version\":\"8.0.0\"},\"host\":{\"name\":\"MHKANG\"},\"agent\":{\"version\":\"8.12.0\",\"ephemeral_id\":\"013c425b-7951-4670-ab30-7432708042cd\",\"id\":\"5d624028-d6db-4bf3-9930-2739c9b72407\",\"name\":\"MHKANG\",\"type\":\"auditbeat\"},\"process\":{\"parent\":{\"pid\":1636},\"hash\":{\"sha1\":\"119965512252f4da4ac86887562e0d4ad4f2d4c3\"},\"entity_id\":\"1vfinYF9dclwaAOM\",\"pid\":216868,\"executable\":\"C:\\\\Splunk\\\\bin\\\\python3.exe\",\"start\":\"2025-06-25T09:40:05.187Z\",\"name\":\"python3.exe\",\"args\":[\"C:\\\\Splunk\\\\bin\\\\Python3.exe\",\"C:\\\\Splunk\\\\bin\\\\runScript.py\",\"rest_vocabularies.Vocabularies\"],\"working_directory\":\"C:\\\\Splunk\\\\bin\"},\"message\":\"Process python3.exe (PID: 216868) by user NT AUTHORITY\\\\SYSTEM STOPPED\",\"user\":{\"group\":{\"id\":\"S-1-5-18\"},\"name\":\"NT AUTHORITY\\\\SYSTEM\",\"id\":\"S-1-5-18\"},\"service\":{\"type\":\"system\"}}"
}
추가된 데이터만 가져온다. 항상 그렇지는 않은데 왔다갔다 하면서 하나만 가져온다. 공식문서는 여러 개 지정할 수 있는 것처럼 설명하는데 버그인가? 다음 설정도 마찬가지.
filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - d:\*.log
filebeat 시작 후 업데이트된 내용이 없어서라고 하기엔 일단 하나는 가져오니까(..) 물론 filestream input 선언을 따로 해주면 가져오긴 한다.
filebeat.inputs:
- type: filestream
  id: my-filestream-id1
  enabled: true
  paths:
    - d:\firewall.log
  prospector.scanner.fingerprint.enabled: false
- type: filestream
  id: my-filestream-id2
  enabled: true
  paths:
    - d:\auditbeat.log
  prospector.scanner.fingerprint.enabled: false  
{
  "@timestamp": "2025-06-27T13:30:19.791Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "log": {
    "file": {
      "path": "d:\\firewall.log"
    }
  },
  "message": "2025-06-24 15:44:30 ALLOW UDP 192.168.31.177 142.250.207.100 64118 443 0 - - - - - - - SEND"
}
{
  "@timestamp": "2025-06-27T13:30:19.791Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "log": {
    "file": {
      "path": "d:\\auditbeat.log"
    }
  },
  "message": "{\"@timestamp\":\"2025-06-25T09:40:17.236Z\",\"@metadata\":{\"beat\":\"auditbeat\",\"type\":\"_doc\",\"version\":\"8.12.0\"},\"event\":{\"kind\":\"event\",\"category\":[\"process\"],\"type\":[\"end\"],\"action\":\"process_stopped\",\"module\":\"system\",\"dataset\":\"process\"},\"ecs\":{\"version\":\"8.0.0\"},\"host\":{\"name\":\"MHKANG\"},\"agent\":{\"version\":\"8.12.0\",\"ephemeral_id\":\"013c425b-7951-4670-ab30-7432708042cd\",\"id\":\"5d624028-d6db-4bf3-9930-2739c9b72407\",\"name\":\"MHKANG\",\"type\":\"auditbeat\"},\"process\":{\"parent\":{\"pid\":1636},\"hash\":{\"sha1\":\"119965512252f4da4ac86887562e0d4ad4f2d4c3\"},\"entity_id\":\"1vfinYF9dclwaAOM\",\"pid\":216868,\"executable\":\"C:\\\\Splunk\\\\bin\\\\python3.exe\",\"start\":\"2025-06-25T09:40:05.187Z\",\"name\":\"python3.exe\",\"args\":[\"C:\\\\Splunk\\\\bin\\\\Python3.exe\",\"C:\\\\Splunk\\\\bin\\\\runScript.py\",\"rest_vocabularies.Vocabularies\"],\"working_directory\":\"C:\\\\Splunk\\\\bin\"},\"message\":\"Process python3.exe (PID: 216868) by user NT AUTHORITY\\\\SYSTEM STOPPED\",\"user\":{\"group\":{\"id\":\"S-1-5-18\"},\"name\":\"NT AUTHORITY\\\\SYSTEM\",\"id\":\"S-1-5-18\"},\"service\":{\"type\":\"system\"}}"
}
인덱스를 따로 저장하고 싶으면 index 옵션 추가.
filebeat.inputs:
- type: filestream
  id: my-filestream-id1
  enabled: true
  paths:
    - d:\firewall.log
  prospector.scanner.fingerprint.enabled: false
  index: "firewall-%{+yyyy}"
- type: filestream
  id: my-filestream-id2
  enabled: true
  paths:
    - d:\auditbeat.log
  prospector.scanner.fingerprint.enabled: false
  index: "auditlog-%{+yyyy}" 
커스텀 인덱스 만드는 거 쉬웠군. 공식 문서를 꼼꼼히 읽지 않으면 언제나 조져지는 건 나(..)
관련 글
Winlogbeat 8.12의 변화
Filebeat 9.0의 변화

Filebeat의 multi path

댓글