filebeat.yml

#==========================  Modules configuration =============================
filebeat.modules:
#--------------------------- nginx input ----------------------------
- module: nginx
  access:
    enabled: false
  ingress_controller:
    enabled: false
  error:
    enabled: true

#--------------------------- mysql input ----------------------------
- module: mysql
  error:
    enabled: true


#=========================== Filebeat inputs =============================
filebeat.inputs:
#--------------------------- magento input ----------------------------
- type: filestream
  enabled: true
  id: Magento 2 logs
  paths:
    - MAGENTO_ROOT_PATH/var/log/system.log

  fields_under_root: true
  fields:
    service.type: "magento"
    domain: "MAGENTO_DOMAIN"

  parsers:
    - multiline:
        pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{6}\+[0-9]{2}:[0-9]{2}\]'
        negate: true
        match: after

  processors:
    - drop_event:
        when:
          regexp:
            message: 'main.INFO:'
    - dissect:
        tokenizer: '[%{date}] main.%{level}: '
        field: "message"
        target_prefix: "log"
    - timestamp:
        field: date
        layouts:
          - '2006-01-02T15:04:05.000000+00:00'
        test:
          - '2022-11-25T18:24:05.000000+00:00'
    - drop_fields:
        fields: ["log.date"]

 #--------------------------- php-fpm input ----------------------------
- type: filestream
  enabled: true
  id: Magento 2 php-fpm logs
  paths:
    - MAGENTO_ROOT_PATH/var/log/php-fpm-error.log

  fields_under_root: true
  fields:
    service.type: "php"
    domain: "MAGENTO_DOMAIN"

  parsers:
    - multiline:
        pattern: '^\[[0-9]{2}-\w{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} '
        negate: true
        match: after

  processors:
    - drop_event:
        when:
          regexp:
            message: 'PHP Warning'
    - dissect:
        tokenizer: '[%{date} MAGENTO_TIMEZONE] PHP %{level} error'
        field: "message"
        target_prefix: "log"
    - timestamp:
        field: log.date
        layouts:
          - '26-Nov-2022 21:28:15'
        test:
          - '26-Nov-2022 21:28:15'
    - drop_fields:
        fields: ["log.date"]

#--------------------------- elasticsearch output ----------------------------
setup.template:
  name: "magento_logs"
  pattern: "magento_logs-%{[service.type]}-*"
  overwrite: true
  enabled: false

setup.ilm.enabled: false

output.elasticsearch:
  hosts: ['http://127.0.0.1:9200']
  username: "magento_logs"
  password: "MAGENTO_LOGS_PASSWORD"
  indices:
    - index: "magento_logs-%{[service.type]}-%{[domain]}-%{+yyyy.MM.dd}"
      when.has_fileds: ["domain"]
    - index: "magento_logs-%{[service.type]}-%{+yyyy.MM.dd}"
      when.not.has_fields: ["domain"]

monitoring:
  enabled: false