The default configuration is below in case you wish to just copy it and edit: # Filebeat Configuration Example # Start or stop the filebeat service with the following: sudo systemctl start filebeat You can get the status with: systemctl status filebeat You can use the following commands to make sure the filebeat service automatically starts on boot, or doesn't: sudo systemctl enable filebeat To run filebeat and see what it is doing, run the following command: filebeat -e Theres a lot more other configuration changes you can make, especially around configuring Kibana and dashbards, but that is beyond the scope of this tutorial. You may likely have your own elasticsearch server(s). By default it will point to localhost, but The first thing we probably want to do is point filebeat at our elasticsearch host. If you want to use filebeat for parsing Apache log files, then enable the apache module sudo filebeat modules enable apacheĬonfigure filebeat sudo vim /etc/filebeat/filebeat.yml To see if there is a module for whatever service you are running, list the modules by running: sudo filebeat modules list You probably want to install a module for whatever logs you are wanting filebeat to parse and send of to apache. Sudo apt-get install apt-transport-https -yĮcho "deb stable main" | sudo tee -a /etc/apt//elastic-7.x.list Run the following commands to install filebeat on Ubuntu 18.04. If you wish to use filebeat within a docker container, be sure to check out my Dockerized Apache with Filebeat example on Github.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |