I have the below setup:
I have 2 csv files
file2.csv which I am pushing with collector/filebeat to the Graylog Server.
The Graylog Server is running a single
beats input on port
I have created 2 configurations for each csv file with the proper tags and it is working fine.
The configurations are also set to add a field “
SOURCE” with values S1 and S2 respectively so that I can identify each csv file form data.
file1.csv has 2 columns Col1A, Col1B
file2.csv has 2 columns Col2A, Col2B
Now, in the inputs section, I added an
extractor to convert CSV to fields.
Copy Input function I specified that the column names are
Col1A and Col1B.
But this rule will get applied to all data that the inputs receives which I don’t want.
I want to be able to add another
CopyInput section to specify fields
Col2A, Col2B for the second file as well.
I am unable to achieve this.
Please suggest what is the best way to achieve this.
Note: I would prefer to have a single
beats input on Graylog Server.