filebeat-geth.yml

filebeat.prospectors:
- input_type: log
  paths:
    - /Users/ia/Library/EthereumClassic/mainnet/mlogs/geth*
  symlinks: true
  json.message_key: event
  json.keys_under_root: true
  exclude_files: ['\.gz$']
  tags: ["mainnet", "isaac"]
  clean_inactive: "6h"
  ignore_older: "5h"
  close_inactive: "4h"
  close_renamed: true
  clean_removed: true
  tail_files: true
- input_type: log
  paths:
    - /Users/ia/Library/EthereumClassic/morden/mlogs/geth*
  symlinks: true
  json.message_key: event
  json.keys_under_root: true
  exclude_files: ['\.gz$']
  clean_inactive: "6h"
  ignore_older: "5h"
  close_inactive: "4h"
  close_renamed: true
  clean_removed: true
  tail_files: true
  tags: ["morden", "isaac"]

output.logstash:
  hosts: ["178.62.224.190:5000"]

  # For eventually buckling down the hatches.
  # ssl.certificate: "/usr/local/etc/filebeat/etcdevmon.logstash.crt"
  # ssl.key: "/usr/local/etc/filebeat/etcdevmon.logstash.key"
  
  # This is will set the index prefix for elasticsearch indices. Important when
  # aggregating logs from multiple machines and instances.
  index: "etcdev-v1"

# Filebeat logs settings.
logging:
  level: info
  to_files: true
  to_syslog: false
  files:
    keepfiles: 7
    permissions: 0777

777 is bad, I suggest 644 at most.