diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 5f3e62942c3..498b6739ef6 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -953,6 +953,7 @@ for a few releases. Please use other tools provided by Elastic to fetch data fro *Filebeat* +- Deprecate `log` input in favour of `filestream` input. {pull}28623[28623] *Heartbeat* diff --git a/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl b/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl index f7e0dc79fc7..a47e70d98c2 100644 --- a/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl +++ b/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl @@ -10,8 +10,8 @@ filebeat.inputs: # The different types cannot be mixed in one input # # Possible options are: -# * log: Reads every line of the log file (default) -# * filestream: Improved version of log input +# * filestream: Reads every line of the log file +# * log: Reads every line of the log file (deprecated) # * stdin: Reads the standard in #------------------------------ Log input -------------------------------- diff --git a/filebeat/_meta/config/filebeat.inputs.yml.tmpl b/filebeat/_meta/config/filebeat.inputs.yml.tmpl index 2555aa26577..ebd0ce83a4c 100644 --- a/filebeat/_meta/config/filebeat.inputs.yml.tmpl +++ b/filebeat/_meta/config/filebeat.inputs.yml.tmpl @@ -6,51 +6,7 @@ filebeat.inputs: # you can use different inputs for various configurations. # Below are the input specific configurations. -- type: log - - # Change to true to enable this input configuration. - enabled: false - - # Paths that should be crawled and fetched. Glob based paths. - paths: - - /var/log/*.log - #- c:\programdata\elasticsearch\logs\* - - # Exclude lines. A list of regular expressions to match. It drops the lines that are - # matching any regular expression from the list. - #exclude_lines: ['^DBG'] - - # Include lines. A list of regular expressions to match. It exports the lines that are - # matching any regular expression from the list. - #include_lines: ['^ERR', '^WARN'] - - # Exclude files. A list of regular expressions to match. Filebeat drops the files that - # are matching any regular expression from the list. By default, no files are dropped. - #exclude_files: ['.gz$'] - - # Optional additional fields. These fields can be freely picked - # to add additional information to the crawled log files for filtering - #fields: - # level: debug - # review: 1 - - ### Multiline options - - # Multiline can be used for log messages spanning multiple lines. This is common - # for Java Stack Traces or C-Line Continuation - - # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [ - #multiline.pattern: ^\[ - - # Defines if the pattern set under pattern should be negated or not. Default is false. - #multiline.negate: false - - # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern - # that was (not) matched before or after or as long as a pattern is not matched based on negate. - # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash - #multiline.match: after - -# filestream is an input for collecting log messages from files. It is going to replace log input in the future. +# filestream is an input for collecting log messages from files. - type: filestream # Change to true to enable this input configuration. diff --git a/filebeat/docs/inputs/input-log.asciidoc b/filebeat/docs/inputs/input-log.asciidoc index 95c037707b3..9a88a90e199 100644 --- a/filebeat/docs/inputs/input-log.asciidoc +++ b/filebeat/docs/inputs/input-log.asciidoc @@ -3,6 +3,10 @@ [id="{beatname_lc}-input-{type}"] === Log input +deprecated:[7.16.0] + +The log input is deprecated. Please use the the <> for sending log files to outputs. + ++++ Log ++++ diff --git a/filebeat/filebeat.reference.yml b/filebeat/filebeat.reference.yml index 055de812f9c..21340ec43b2 100644 --- a/filebeat/filebeat.reference.yml +++ b/filebeat/filebeat.reference.yml @@ -417,8 +417,8 @@ filebeat.inputs: # The different types cannot be mixed in one input # # Possible options are: -# * log: Reads every line of the log file (default) -# * filestream: Improved version of log input +# * filestream: Reads every line of the log file +# * log: Reads every line of the log file (deprecated) # * stdin: Reads the standard in #------------------------------ Log input -------------------------------- diff --git a/filebeat/filebeat.yml b/filebeat/filebeat.yml index 87521d1df44..41218cbb7f2 100644 --- a/filebeat/filebeat.yml +++ b/filebeat/filebeat.yml @@ -18,51 +18,7 @@ filebeat.inputs: # you can use different inputs for various configurations. # Below are the input specific configurations. -- type: log - - # Change to true to enable this input configuration. - enabled: false - - # Paths that should be crawled and fetched. Glob based paths. - paths: - - /var/log/*.log - #- c:\programdata\elasticsearch\logs\* - - # Exclude lines. A list of regular expressions to match. It drops the lines that are - # matching any regular expression from the list. - #exclude_lines: ['^DBG'] - - # Include lines. A list of regular expressions to match. It exports the lines that are - # matching any regular expression from the list. - #include_lines: ['^ERR', '^WARN'] - - # Exclude files. A list of regular expressions to match. Filebeat drops the files that - # are matching any regular expression from the list. By default, no files are dropped. - #exclude_files: ['.gz$'] - - # Optional additional fields. These fields can be freely picked - # to add additional information to the crawled log files for filtering - #fields: - # level: debug - # review: 1 - - ### Multiline options - - # Multiline can be used for log messages spanning multiple lines. This is common - # for Java Stack Traces or C-Line Continuation - - # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [ - #multiline.pattern: ^\[ - - # Defines if the pattern set under pattern should be negated or not. Default is false. - #multiline.negate: false - - # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern - # that was (not) matched before or after or as long as a pattern is not matched based on negate. - # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash - #multiline.match: after - -# filestream is an input for collecting log messages from files. It is going to replace log input in the future. +# filestream is an input for collecting log messages from files. - type: filestream # Change to true to enable this input configuration. diff --git a/filebeat/input/log/input.go b/filebeat/input/log/input.go index 919c66396cb..59aff9b7bfd 100644 --- a/filebeat/input/log/input.go +++ b/filebeat/input/log/input.go @@ -36,6 +36,7 @@ import ( "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/common/atomic" + "github.com/elastic/beats/v7/libbeat/common/cfgwarn" "github.com/elastic/beats/v7/libbeat/logp" "github.com/elastic/beats/v7/libbeat/monitoring" ) @@ -51,6 +52,8 @@ var ( harvesterSkipped = monitoring.NewInt(nil, "filebeat.harvester.skipped") errHarvesterLimit = errors.New("harvester limit reached") + + deprecatedNotificationOnce sync.Once ) func init() { @@ -82,6 +85,10 @@ func NewInput( outlet channel.Connector, context input.Context, ) (input.Input, error) { + deprecatedNotificationOnce.Do(func() { + cfgwarn.Deprecate("", "Log input. Use Filestream input instead.") + }) + cleanupNeeded := true cleanupIfNeeded := func(f func() error) { if cleanupNeeded { diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 91f8bf0bd2e..253900e98c2 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -2405,8 +2405,8 @@ filebeat.inputs: # The different types cannot be mixed in one input # # Possible options are: -# * log: Reads every line of the log file (default) -# * filestream: Improved version of log input +# * filestream: Reads every line of the log file +# * log: Reads every line of the log file (deprecated) # * stdin: Reads the standard in #------------------------------ Log input -------------------------------- diff --git a/x-pack/filebeat/filebeat.yml b/x-pack/filebeat/filebeat.yml index 87521d1df44..41218cbb7f2 100644 --- a/x-pack/filebeat/filebeat.yml +++ b/x-pack/filebeat/filebeat.yml @@ -18,51 +18,7 @@ filebeat.inputs: # you can use different inputs for various configurations. # Below are the input specific configurations. -- type: log - - # Change to true to enable this input configuration. - enabled: false - - # Paths that should be crawled and fetched. Glob based paths. - paths: - - /var/log/*.log - #- c:\programdata\elasticsearch\logs\* - - # Exclude lines. A list of regular expressions to match. It drops the lines that are - # matching any regular expression from the list. - #exclude_lines: ['^DBG'] - - # Include lines. A list of regular expressions to match. It exports the lines that are - # matching any regular expression from the list. - #include_lines: ['^ERR', '^WARN'] - - # Exclude files. A list of regular expressions to match. Filebeat drops the files that - # are matching any regular expression from the list. By default, no files are dropped. - #exclude_files: ['.gz$'] - - # Optional additional fields. These fields can be freely picked - # to add additional information to the crawled log files for filtering - #fields: - # level: debug - # review: 1 - - ### Multiline options - - # Multiline can be used for log messages spanning multiple lines. This is common - # for Java Stack Traces or C-Line Continuation - - # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [ - #multiline.pattern: ^\[ - - # Defines if the pattern set under pattern should be negated or not. Default is false. - #multiline.negate: false - - # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern - # that was (not) matched before or after or as long as a pattern is not matched based on negate. - # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash - #multiline.match: after - -# filestream is an input for collecting log messages from files. It is going to replace log input in the future. +# filestream is an input for collecting log messages from files. - type: filestream # Change to true to enable this input configuration.