Elasticsearch Advanced Dashboard

Video Lecture

Description

Now to install an advanced dashboard that uses both the Filebeat and Metricbeat datasources at the same time.

I will set this up on my linux server where the Filebeat process is already running.

Download Metricbeat for your OS from https://www.elastic.co/downloads/beats/metricbeat

My OS is a Debian based Ubuntu 20.04

curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-7.10.0-amd64.deb
sudo dpkg -i metricbeat-7.10.0-amd64.deb

Navigate to the Metricbeat folder.

cd /etc/metricbeat
ls -lh

Edit the Metricbeat settings.

sudo nano /etc/metricbeat/metricbeat.yml

View the available modules and status

metricbeat modules list

Now to install the 'OS stats - Linux' dashboard from https://grafana.com/grafana/dashboards/12626

Import a new dashboard using the ID 12626

Choose the correct Filebeat and Metricbeat datasources and then continue.

Not all panels will contain data, so you will need to edit the /etc/metricbeat/modules.d/system.yml file on the host running Metricbeat.

My /etc/metricbeat/modules.d/system.yml has these settings

# Module: system
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.10/metricbeat-module-system.html

- module: system
  period: 30s
  metricsets:
    - cpu
    - load
    - memory
    - network
    - process
    - process_summary
    - socket_summary
    #- entropy
    #- core
    - diskio
    #- socket
    - service
    - users
  process.include_top_n:
    by_cpu: 10      # include top 10 processes by CPU
    by_memory: 10   # include top 10 processes by memory

- module: system
  period: 1m
  metricsets:
    - filesystem
    - fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)'

- module: system
  period: 15m
  metricsets:
    - uptime

#- module: system
#  period: 5m
#  metricsets:
#    - raid
#  raid.mount_point: '/'