# https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-reference-yml.html

filebeat.modules:
- module: system
  syslog:
    enabled: true
  auth:
    enabled: true

filebeat.inputs:
- type: container
  paths:
    -/var/lib/docker/containers/*/*.log

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      templates:
        - condition:
            contains:
              docker.container.image: smardigo
          config:
            - type: container
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              multiline.pattern: '^{|^[0-9]{4}-[0-9]{2}-[0-9]{2}'
              multiline.negate: true
              multiline.match: after

fields:
  stage: {{ stage }}
  hostname: {{ inventory_hostname }}

output.logstash:
  hosts: ["{{ shared_service_elastic_stack_logstash_01_hostname }}:5044"]
  ssl:
    certificate_authorities:
      - /usr/share/filebeat/config/certificates/ca/ca.crt
    certificate: /usr/share/filebeat/config/certificates/{{ filebeat_certificate }}/{{ filebeat_certificate }}.crt
    key: /usr/share/filebeat/config/certificates/{{ filebeat_certificate }}/{{ filebeat_certificate }}.key