Стандартный конфигурационный файл Filebeat

filebeat.inputs:
  # MS IIS
  - type: log
    enabled: true
    paths:
      - C:\inetpub\logs\LogFiles\*\*.log
    exclude_lines: ['^#']
    tags: ["ms-iis", "access-full"]
    ignore_older: 72h

  # MS EXCHANGE
  - type: log
    paths:
    # Mailbox servers:
    #    - MSGTRK files for the Transport service
    #    - MSGTRMD files for the Mailbox Transport Delivery service
    #    - MSGTRMS files for the Mailbox Transport Submission service

    # Transport service on Edge Transport servers:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\*

    enabled: true
    exclude_lines: ["^#"]
    tags: ["exchange", "msgtrk"]

  - type: log
    paths:
    # Mailbox servers:
    #   Front End Transport service Receive connectors:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\*
    #   Front End Transport service Send connectors:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpSend\*

    #   Transport service Receive connectors:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive\*
    #   Transport service Send connectors:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend\*

    # Mailbox Transport Delivery service (Receive Connectors):
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpReceive\Delivery\*

    # Mailbox Transport Submission service Send connectors:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpSend\Submission\*
    # Mailbox Transport Submission service Side effect messages:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpSend\Delivery\*

    # Transport service on Edge Transport servers Receive connectors:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Edge\ProtocolLog\SmtpReceive\*
    # Transport service on Edge Transport servers Receive connectors:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Edge\ProtocolLog\SmtpSend\*

    enabled: true
    exclude_lines: ["^#"]
    tags: ["exchange", "smtp"]

  - type: log
    paths:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Egde\AgentLog\*

    enabled: true
    exclude_lines: ["^#"]
    tags: ["exchange", "antispam"]

output.logstash:
  ssl.enabled: true
  ssl.verification_mode: none

filebeat.inputs:
- type: log
  paths:
    - "/var/log/syslog"
    - "/var/log/messages"
    - "/var/log/auth.log"
    - "/var/log/cron"
    - "/var/log/secure"
    - "/var/log/dnf.rpm.log"
    - "/var/log/yum.log"
    - "/var/log/maillog"
  exclude_files: ['\.gz$']
  ignore_older: 72h
  tags: ["standard", "linux"]

output.logstash:
  ssl.enabled: true
  ssl.verification_mode: none