The input element in the input configuration contains a list of input descriptions, each describing one source of input. The general elements in the json are the following:

typeThe log id for this source-
rowtypeThe type of the row, can be service / audit-
pathThe path of the source, may contain ‘*’ characters too-
add_fieldsThe element contains field_name: field_value pairs which will be added to each rows data-
sourceThe type of the input source, currently file and s3_file are supported-
tailThe input should check for only the latest file matching the pattern, not all of themtrue
gen_event_md5Generate an event_md5 field for each row by creating a hash of the row datatrue
use_event_md5_as_idGenerate an id for each row by creating a hash of the row datafalse
cache_enabledAllows the input to use a cache to filter out duplicationstrue
cache_key_fieldSpecifies the field for which to use the cache to find duplications oflog_message
cache_last_dedup_enabledAllow to filter out entries which are same as the most recent one irrelevant of it's timefalse
cache_sizeThe number of entries to store in the cache100
cache_dedup_intervalThe maximum interval in ms which may pass between two identical log messages to filter the latter out1000
is_enabledA flag to show if the input should be usedtrue

File Input

File inputs have some additional parameters:

checkpoint_interval_msThe time interval in ms when the checkpoint file should be updated5000
process_fileShould the file be processedtrue
copy_fileShould the file be copied (only if not processed)false

S3 File Input

S3 file inputs have the following parameters in addition to the general file parameters:

s3_access_keyThe access key used for AWS credentials-
s3_secret_keyThe secret key used for AWS credentials-