Filebeat 6 configuration in Ubuntu 16

Filebeat 6 configuration in Ubuntu 16

OS             =    Ubuntu 16 64 bit
Elasticsearch Server    =
Logstash Server     =
Kibana Server        =
cd /tmp/


dpkg -i filebeat-6.1.1-amd64.deb

Configure Filebeat

#============= Filebeat prospectors ==============

- type: log

# Change to true to enable this prospector configuration.
 enabled: true

# Paths that should be crawled and fetched. Glob based paths.
    - /var/log/*.log

# Optional additional fields. These fields can be freely picked
# to add additional information to the crawled log files for filtering
# fields:
# level: debug
# review: 1
registry_file: /var/lib/filebeat/registry
#========== Elasticsearch template setting ===========

 index.number_of_shards: 3
 #index.codec: best_compression
 #_source.enabled: false "filebeat"
 setup.template.fields: "/etc/filebeat/fields.yml"
 setup.template.overwrite: false

===================== Kibana ===================


 # Kibana Host
 # Scheme and port can be left out and will be set to the default (http and 5601)
 # In case you specify and additional path, the scheme is required: http://localhost:5601/path
 # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
 host: ""

#-------------------------- Elasticsearch output ------------------------------
 # Array of hosts to connect to.
 hosts: [""] filebeat
 template.path: filebeat.template.json
 # Optional protocol and basic auth credentials.
 #protocol: "https"
 #username: "elastic"
 #password: "changeme"

#----------------------------- Logstash output --------------------------------
 # The Logstash hosts
 hosts: [""]

 # Optional SSL. By default is off.
 # List of root certificates for HTTPS server verifications
 #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

 # Certificate for SSL client authentication
 #ssl.certificate: "/etc/pki/client/cert.pem"

#==================== Logging ====================

# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
#logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]

Restart Filebeat
systemctl restart filebeat
Enable on every boot
systemctl enable filebeat

Next Post »


Write comments
March 14, 2018 at 7:32 PM

If you're still unable to seek out the most effective skilled essay author for you that a write the most effective and distinctive essay for you of any topic does edubirdie work then see and acquire the most effective and skilled essay author for your essay writing and you may fall soft on by seeing the standard of their essay writing work on all-time low rate and short time.

Dona Miller
September 26, 2018 at 11:33 PM

Every week-end I used to pay a fast visit this site, because I’d like enjoyment, because this web site conations certainly fussy material. Accounting Firms in Toronto

william oscar
April 4, 2019 at 11:14 PM

The gorgeous post learned a great deal Thanks greatly!

Accountants in Toronto

April 17, 2019 at 10:49 AM

Very nice blog with nice thinking post. I appreciate your idea and for sharing this acknowledgment.

Quickbooks Support Phone Number