Use filestream input instead of deprecated log

[felixbarny]

Fixes #67

[ghost]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-04-04T04:35:00.842+0000

• Duration: 3 min 8 sec

[cyrille-leclerc]

I think we have to document both filebeat <7.16 with the log input and filebeat >= 7.16 with the filestream input because bumping filebeat may not be easy.

[cyrille-leclerc]

filestream doesn't have the same syntax for the json tricks.

it looks like

- type: filestream
  paths: /path/to/logs.json
  parsers:
      - ndjson:
          keys_under_root: true
          overwrite_keys: true

See https://github.com/cyrille-leclerc/my-shopping-cart/blob/2cde6dda3974143271fe9e2d929ffa59849fa94b/elastic-filebeat/filebeat.yml

[felixbarny]

Thanks, I've added two sections now. I've also added instructions for adding metadata processors. LMKWYT.

[cyrille-leclerc]

MAny thanks @felixbarny