moving from filebeat to vector

[therus000]

Good day
im try to move for file to vector and i got this config

filebeat_path_custom:
  - type: log
    paths:
      - "/var/log/app-1/*.log"
    fields:
      haproxy: true
      product: nlb
    fields_under_root: true
    processors:
      - dissect:
          tokenizer: "%{prefix}[%{pid}]: %{message}"
          field: "message"
          overwrite_keys: true
          target_prefix: ""
      - decode_json_fields:
          fields: ["message"]
          target: "json"
          overwrite_keys: true
      - drop_fields:
          fields: ["prefix", "pid", "log", "ecs"]
          ignore_missing: true

i think i should use file as source for vector. but what about else. any one can help

[therus000]

sources:
  filebeat_custom:
    type: file
    include:
      - "/var/log/app-1/*.log"
transforms:
  dissect_logs:
    type: remap
    inputs:
      - filebeat_custom
    source: |
      .haproxy = true
      .product = "nlb"
      parsed = dissect!(.message, "%{prefix}[%{pid}]: %{message}")
      . = merge(., parsed)
      del(.prefix)
      del(.pid)
      del(.log)
      del(.ecs)
  decode_json:
    type: remap
    inputs:
      - dissect_logs
    source: |
      if exists(.message) {
        .json = parse_json!(.message)
        . = merge(., .json)
        del(.message)
      }

is this will be look same output?

[pront]

Hi @therus000, you should be able to compare output from filebeat vs Vector right? You can paste some log samples here.