Difference between revisions of "Filebeat"
From DarkWiki
(→Installation on Ubuntu) |
(→Installation on Ubuntu) |
||
| Line 9: | Line 9: | ||
sudo apt-get update && sudo apt-get install filebeat | sudo apt-get update && sudo apt-get install filebeat | ||
sudo update-rc.d filebeat defaults 95 10 | sudo update-rc.d filebeat defaults 95 10 | ||
| + | </source> | ||
| + | |||
| + | ==Configuration== | ||
| + | |||
| + | <source lang="yaml"> | ||
| + | filebeat.inputs: | ||
| + | - type: log | ||
| + | enabled: true | ||
| + | paths: | ||
| + | - /var/log/*.log | ||
| + | - type: container | ||
| + | enabled: true | ||
| + | paths: | ||
| + | - "/var/lib/docker/containers/*/*.log" | ||
| + | tags: ["json"] | ||
| + | json.keys_under_root: true | ||
| + | json.add_error_key: true | ||
| + | json.message_key: message | ||
| + | filebeat.config.modules: | ||
| + | path: ${path.config}/modules.d/*.yml | ||
| + | reload.enabled: false | ||
| + | setup.template.settings: | ||
| + | index.number_of_shards: 1 | ||
| + | setup.kibana: | ||
| + | output.logstash: | ||
| + | hosts: ["localhost:5044"] | ||
| + | ssl.enabled: true | ||
| + | ssl.verification_mode: none | ||
| + | ssl.certificate: "/etc/filebeat/logstash-beats.crt" | ||
| + | ssl.key: "/etc/filebeat/logstash-beats.key" | ||
| + | processors: | ||
| + | - add_host_metadata: ~ | ||
| + | - add_cloud_metadata: ~ | ||
</source> | </source> | ||
Revision as of 10:26, 9 September 2019
Installation on Ubuntu
From repositories (see https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html)
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt-get update && sudo apt-get install filebeat
sudo update-rc.d filebeat defaults 95 10
Configuration
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
- type: container
enabled: true
paths:
- "/var/lib/docker/containers/*/*.log"
tags: ["json"]
json.keys_under_root: true
json.add_error_key: true
json.message_key: message
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 1
setup.kibana:
output.logstash:
hosts: ["localhost:5044"]
ssl.enabled: true
ssl.verification_mode: none
ssl.certificate: "/etc/filebeat/logstash-beats.crt"
ssl.key: "/etc/filebeat/logstash-beats.key"
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
