[id="configuration-{beatname_lc}-options"]
== Configure inputs

++++
<titleabbrev>Inputs</titleabbrev>
++++

TIP: <<{beatname_lc}-modules-overview,{beatname_uc} modules>> provide the
fastest getting started experience for common log formats. See
<<{beatname_lc}-installation-configuration>> to learn how to get started.

To configure {beatname_uc} manually (instead of using
<<{beatname_lc}-modules-overview,modules>>), you specify a list of inputs in the
+{beatname_lc}.inputs+ section of the +{beatname_lc}.yml+. Inputs specify how
{beatname_uc} locates and processes input data.

The list is a http://yaml.org/[YAML] array, so each input begins with
a dash (`-`). You can specify multiple inputs, and you can specify the same
input type more than once. For example:

["source","yaml",subs="attributes"]
----
{beatname_lc}.inputs:
- type: filestream
  id: my-filestream-id <1>
  paths:
    - /var/log/system.log
    - /var/log/wifi.log
- type: filestream
  id: apache-filestream-id
  paths:
    - "/var/log/apache2/*"
  fields:
    apache: true
  fields_under_root: true
----

<1> Each filestream input must have a unique ID to allow tracking the state of files.

For the most basic configuration, define a single input with a single path. For
example:

[source,yaml]
-------------------------------------------------------------------------------------
filebeat.inputs:
- type: filestream
  id: my-filestream-id
  paths:
    - /var/log/*.log
-------------------------------------------------------------------------------------

The input in this example harvests all files in the path `/var/log/*.log`, which
means that {beatname_uc} will harvest all files in the directory `/var/log/`
that end with `.log`. All patterns supported by
https://golang.org/pkg/path/filepath/#Glob[Go Glob] are also supported here.

To fetch all files from a predefined level of subdirectories, use this pattern:
`/var/log/*/*.log`. This fetches all `.log` files from the subfolders of
`/var/log`. It does not fetch log files from the `/var/log` folder itself.
Currently it is not possible to recursively fetch all files in all
subdirectories of a directory.

[float]
[id="{beatname_lc}-input-types"]
=== Input types

You can configure {beatname_uc} to use the following inputs:

* <<{beatname_lc}-input-aws-cloudwatch>>
* <<{beatname_lc}-input-aws-s3>>
* <<{beatname_lc}-input-azure-eventhub>>
* <<{beatname_lc}-input-cloudfoundry>>
* <<{beatname_lc}-input-container>>
* <<{beatname_lc}-input-docker>>
* <<{beatname_lc}-input-filestream>>
* <<{beatname_lc}-input-gcp-pubsub>>
* <<{beatname_lc}-input-http_endpoint>>
* <<{beatname_lc}-input-httpjson>>
* <<{beatname_lc}-input-journald>>
* <<{beatname_lc}-input-kafka>>
* <<{beatname_lc}-input-log>> (deprecated in 7.16.0, use <<{beatname_lc}-input-filestream>>)
* <<{beatname_lc}-input-mqtt>>
* <<{beatname_lc}-input-netflow>>
* <<{beatname_lc}-input-o365audit>>
* <<{beatname_lc}-input-redis>>
* <<{beatname_lc}-input-stdin>>
* <<{beatname_lc}-input-syslog>>
* <<{beatname_lc}-input-tcp>>
* <<{beatname_lc}-input-udp>>

include::multiline.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-aws-cloudwatch.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-azure-eventhub.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-cloudfoundry.asciidoc[]

include::inputs/input-container.asciidoc[]

include::inputs/input-docker.asciidoc[]

include::inputs/input-filestream.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-gcp-pubsub.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-http-endpoint.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-httpjson.asciidoc[]

include::inputs/input-journald.asciidoc[]

include::inputs/input-kafka.asciidoc[]

include::inputs/input-log.asciidoc[]

include::inputs/input-mqtt.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-netflow.asciidoc[]

include::../../x-pack/filebeat/docs/inputs/input-o365audit.asciidoc[]

include::inputs/input-redis.asciidoc[]

include::inputs/input-stdin.asciidoc[]

include::inputs/input-syslog.asciidoc[]

include::inputs/input-tcp.asciidoc[]

include::inputs/input-udp.asciidoc[]

include::inputs/input-unix.asciidoc[]
