Filebeat Setup Exercise

  • Download public key for the repository:
    curl -O https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
    
  • Add repository to the list:
    echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-5.x.list
    
  • Install Filebeat from the repository:
    sudo apt-get update && sudo apt-get install filebeat
    
  • Configure the logs location:
    sudo nano /etc/filebeat/filebeat.yml
    
  • Important settings:

    - input_type: log  
      paths:  
        - /var/log/*.log  
    
    output.elasticsearch:  
      hosts: ["localhost:9200"]  
      template.enabled: true  
      template.path: "/etc/filebeat/filebeat.template.json"  
      template.overwrite: false  
      index: "filebeat"
    
  • Start Filebeat service and check the status:
    sudo service filebeat start && sudo service filebeat status
    
  • Query ElasticSearch using curl to confirm new index has been created: 'filebeat':
    curl 'localhost:9200/_cat/indices?format=json'
    
  • Query the data inside the newly created index:
    curl 'localhost:9200/filebeat/_search?pretty=true'
    

results matching ""

    No results matching ""