Filebeat Setup Exercise

  • Download public key for the repository:
    curl -O | sudo apt-key add -
  • Add repository to the list:
    echo "deb stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-5.x.list
  • Install Filebeat from the repository:
    sudo apt-get update && sudo apt-get install filebeat
  • Configure the logs location:
    sudo nano /etc/filebeat/filebeat.yml
  • Important settings:

    - input_type: log  
        - /var/log/*.log  
      hosts: ["localhost:9200"]  
      template.enabled: true  
      template.path: "/etc/filebeat/filebeat.template.json"  
      template.overwrite: false  
      index: "filebeat"
  • Start Filebeat service and check the status:
    sudo service filebeat start && sudo service filebeat status
  • Query ElasticSearch using curl to confirm new index has been created: 'filebeat':
    curl 'localhost:9200/_cat/indices?format=json'
  • Query the data inside the newly created index:
    curl 'localhost:9200/filebeat/_search?pretty=true'

results matching ""

    No results matching ""