filebeat.prospectors: - type: log enabled: true paths: - /export/logs/server-switch-server/server-switch.log multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}' multiline.negate: true multiline.match: after filebeat.config.modules: path: ${path.config}/modules.d/*.yml reload.enabled: false setup.template.settings: index.number_of_shards: 5 index.number_of_replicas: 1 output.logstash: hosts: ["tb-b3-zwatcher2:5044"]