Install Filebeat
Local Installation
Run the following commands to install filebeat on Ubuntu 18.04. Probably works with Ubuntu 20.04 too.
Alternatively, for those who have prog-exec
List Modules
You probably want to install a module for whatever logs you are wanting filebeat to parse and send of to apache. To see if there is a module for whatever service you are running, list the modules by running:
Optional - Apache Module
If you want to use filebeat for parsing Apache log files, then enable the apache module
Configure Filebeat
Configure filebeat
The first thing we probably want to do is point filebeat at our elasticsearch host. By default it will point to localhost, but you may likely have your own elasticsearch server(s).
Theres a lot more other configuration changes you can make, especially around configuring Kibana and dashbards, but that is beyond the scope of this tutorial.
Run Filebeat
To run filebeat and see what it is doing, run the following command:
Managing Filebeat Service
You can use the following commands to make sure the filebeat service automatically starts on boot, or doesn't:
Get Status
You can get the status with:
Start / Stop
Start or stop the filebeat service with the following:
Appendix
Default Filebeat Configuration
The default configuration is below in case you wish to just copy it and edit:
References
- Elastic.co - Repositories for APT and YUM
- Docker Monitoring with the ELK Stack: A Step-by-Step Guide
- Elastic.co - Get started with Filebeat
- logit.io - Configure Filebeat to ship logs from Apache to Logstash and Elasticsearch.
- logz.io - filebeat tutorial
First published: 23rd August 2020