The input element in the input configuration contains a list of input descriptions, each describing one source of input. The general elements in the json are the following:
Field | Description | Default |
---|---|---|
type | The log id for this source | - |
rowtype | The type of the row, can be service / audit | - |
path | The path of the source, may contain ‘*’ characters too | - |
add_fields | The element contains field_name: field_value pairs which will be added to each rows data | - |
source | The type of the input source, currently file and s3_file are supported | - |
tail | The input should check for only the latest file matching the pattern, not all of them | true |
gen_event_md5 | Generate an event_md5 field for each row by creating a hash of the row data | true |
use_event_md5_as_id | Generate an id for each row by creating a hash of the row data | false |
cache_enabled | Allows the input to use a cache to filter out duplications | true |
cache_key_field | Specifies the field for which to use the cache to find duplications of | log_message |
cache_last_dedup_enabled | Allow to filter out entries which are same as the most recent one irrelevant of it's time | false |
cache_size | The number of entries to store in the cache | 100 |
cache_dedup_interval | The maximum interval in ms which may pass between two identical log messages to filter the latter out | 1000 |
is_enabled | A flag to show if the input should be used | true |
File inputs have some additional parameters:
Field | Description | Default |
---|---|---|
checkpoint_interval_ms | The time interval in ms when the checkpoint file should be updated | 5000 |
process_file | Should the file be processed | true |
copy_file | Should the file be copied (only if not processed) | false |
S3 file inputs have the following parameters in addition to the general file parameters:
Field | Description | Default |
---|---|---|
s3_access_key | The access key used for AWS credentials | - |
s3_secret_key | The secret key used for AWS credentials | - |