oooh … here is another thing I missed… You also need a dash in front of type:
filebeat:
inputs:
- type: log
enabled: true
Fingers crossed that’s it! Below is a working filebeat I use for watching Owa… hopefully it will help too:
# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}
output.logstash:
hosts:
- ${user.BeatsInput}
ssl:
verification_mode: none
path:
data: C:\Program Files\Graylog\sidecar\cache\winlogbeat\data
logs: C:\Program Files\Graylog\sidecar\logs
tags:
- windows, exchange, filebeat, OWA, e-mail
filebeat:
inputs:
- type: log
enabled: true
# find owa logon and logoff but not when the HealthMailbox does it.
include_lines: ['auth.owa', 'logoff.owa']
exclude_lines: ['HealthMailbox','^#']
paths:
- C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Owa\*.LOG