fields_under_root: true filebeat.inputs: - type: log paths: - ./input/log.log* encoding: plain tags: ["analytic"] fields: service: log close_timeout: 30s close_inactive: 15s scan_frequency: 1s multiline.type: "count" multiline.count_lines: 100 queue.mem: events: 32 flush.min_events: 0 output.file: path: ./output filename: filebeat.out rotate_every_kb: 250000 number_of_files: 50 logging: level: info files: rotateeverybytes: 104857600 keepfiles: 10