I have filebeat on a host scraping many different types of logs and sending them to a graylog’s beats input.
All of these logs are different though (as I run different things on this host).
They all enter the same input, but I have separated them into different streams using rules that use “file” (i.e., filename) filters. So now I have all the different types of logs all separated out and I have alerts for errors, etc.
Now I’d like to do something like “extractors” on each stream. I know how to do them on each input, but in my case, all my logs are entering the same input.
Is there a way forward possible for me now? Is there a different way to achieve the same effect?